Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API Authentication #652

Closed
eyedol opened this issue Jul 1, 2012 · 1 comment
Closed

API Authentication #652

eyedol opened this issue Jul 1, 2012 · 1 comment
Labels
Bug P2 - Normal
Milestone
Ushahidi v2.5

Comments

@eyedol
Copy link
Collaborator

eyedol commented Jul 1, 2012

The API auth uses the same web auth. This opens up for CSRF exploitation. A quick fix is to reset the $_SESSION variable when there is an API request that requires authentication.
@rjmackay
Copy link
Contributor

rjmackay commented Jul 4, 2012

Quick fix for this queued for 2.5

rjmackay added a commit to rjmackay/Ushahidi_Web that referenced this issue Jul 5, 2012
@rjmackay
Stop API requests being authenticated by users session ushahidi#652
6e7aaa8 
* API requests are stateless so should ignore sessions
* API requests should authenticate on EVERY request
rjmackay added a commit to rjmackay/Ushahidi_Web that referenced this issue Jul 5, 2012
@rjmackay
Stop API requests being authenticated by users session ushahidi#652
8375c57 
* API requests are stateless so should ignore sessions
* API requests should authenticate on EVERY request
@rjmackay rjmackay closed this as completed Jul 5, 2012
@rjmackay rjmackay mentioned this issue Aug 13, 2012
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug P2 - Normal
Projects
None yet
Milestone
Ushahidi v2.5
Development

No branches or pull requests
2 participants
@rjmackay @eyedol