[Bug]: vmq_http_pub plugins apis not restricted by api key and bounded to default http listener about vernemq

[mths1]

Thank you very much for reporting this. If the plugin is disabled (which it is by default) it is impossible to send data through the rest api. It it is enabled, I can confirm that vmq_http_pub is part of the default listerners, which is different than what is documented. I also consider to enforce API Keys as a best practice, so that there are secure defaults.

[mths1]

@ashishislive : It is merged to main. Would be great if you could test again.

[ashishislive]

Thank you for checking this. I've gone through testing on top of the incoming changes, now the endpoint http://127.0.01:8888/restmqtt/api/v1/publish start throwing 404 instead of success. Seems like it is no longer part of default listener. (I think it is expected behaviour as per your changes)

I also noticed when using separate listener.http.http_pub = 127.0.0.1:3001 it always through 401 even passing valid apikey. Please find sample request below:

curl --location 'http://127.0.0.1:3001/restmqtt/api/v1/publish' \ --header 'Content-Type: application/json' \ --header 'X-API-KEY: Bgy8eon7sxQsRMHO6Ll8BtlLYR5UIn2X' \ --data '{ "topic": "test", "user": "testuser", "password": "test123", "qos": 1, "retain": false, "payload": "this is a payload string", "user_properties": [{"a":"b"}] }'

[ioolkos]

@ashishislive
Can you try adding an API key for your http_pub listener: vmq-admin api-key create scope=httppub and then use that in the request?
(docs: https://docs.vernemq.com/v/master/live-administration/http-administration)

---

👉 Thank you for supporting VerneMQ: https://github.com/sponsors/vernemq
👉 Using the binary VerneMQ packages commercially (.deb/.rpm/Docker) requires a paid subscription.

[ashishislive]

The issue is resolved after using scope=httppub, apikey created without scope does not work (expected as it belong to different module). Although I did not find any document about httppub scope. I think there is room for improvement in documentation.

[ashishislive]

Original issue is resolved hence closing the issue with following notes:

• Default http listener no longer part of vmq_http_pub (expected)
• Scope specific (httppub) Api key required for authentication (expected)

There is room for improvement in documentation for the same.

[ioolkos]

@ashishislive Thanks for testing & apologies for the missing docs.

---

👉 Thank you for supporting VerneMQ: https://github.com/sponsors/vernemq
👉 Using the binary VerneMQ packages commercially (.deb/.rpm/Docker) requires a paid subscription.