search

IQSS / dataverse

Open source research data repository software
http://dataverse.org
Other
878 stars 490 forks source link

Don't send long lived API token in the URL for external tools #4414

Closed scolapasta closed 2 months ago

scolapasta commented 6 years ago

Currently when we go to a tool like TwoRavens, we send the API token in the URL. We needs these such tools to accept the token in the header, and for the dataverse side to send them in the header.

(From Backlog Grooming 1/31) When will make this change, we should support both for a while and then make the change to require it in the header instead of the URL. We should include these messages in the documentation.

matthew-a-dunlap commented 6 years ago

I've been digging into using a header to send the api token during a redirect. A lot of what I'm reading says that when you do a redirect the headers are no longer present (which is also what I've seen from the bit of code I've tested).

"HTTP headers are valid only for the current response. When you set a redirect the current response contains your custom header but when the browser follows the redirect location those headers are no longer present." https://stackoverflow.com/questions/4070430/response-redirect-with-headers

A lot of what I've seen has said to pass the needed data in the url... tho I get why we don't want to do that with our api token. Redirects/requests/response are an area I'm building knowledge on and would appreciate any ideas other folks have!

pameyer commented 6 years ago

~Depending on what's doing the redirect, this might be something that's addressable in the web server config (I've had to do additional configuration for forwarding custom headers for some other cases).~

From conversation, this won't help.

matthew-a-dunlap commented 6 years ago

I discussed a bit more with @pameyer , we think we'll need a different approach than one involving the server config, as our issue is the browser redirecting to an external application.

We discussed digging into redirecting post requests, and I found this forum discussing 307/308 requests as well as a solution using forms to pass information https://softwareengineering.stackexchange.com/questions/99894/why-doesnt-http-have-post-redirect .

Also another another post that says most browser support 307 / 308 but not IE on older browsers https://stackoverflow.com/questions/42703671/which-browsers-support-307-308-redirects-and-how-do-they-handle-them

matthew-a-dunlap commented 6 years ago

Alllso, another stackoverflow with Balus C pretty much saying we can't do what we were hoping with standard jsf redirect: https://stackoverflow.com/questions/31416856/jsf-2-external-redirect-and-add-header-while-re-directing

matthew-a-dunlap commented 6 years ago

There has been a fair amount of discussion around this today. We first looked towards using a 307/308 redirect to post the token to the external domain in request body. This works and will stop users from accidentally copy-pasting their api token to one another in the url. But there are other areas around our use of the API token that could be improved, and we don't want to force multiple updates on to our external applications unless it is required.

In the end it was decided to pull this story out of development for future discussion and design.

djbrooke commented 3 years ago

Note to self - this is a post-MVP OpenDP need and will be more important as we move towards sensitive data support in Dataverse. We should implement more sooner than later.

djbrooke commented 3 years ago
pdurbin commented 11 months ago

Wasn't this delivered by the following pull request?

cmbz commented 2 months ago

To focus on the most important features and bugs, we are closing issues created before 2020 (version 5.0) that are not new feature requests with the label 'Type: Feature'.

If you created this issue and you feel the team should revisit this decision, please reopen the issue and leave a comment.