search

marcoschwartz / aREST

A RESTful environment for Arduino
http://aREST.io/
Other
1.2k stars 279 forks source link

API key not securing device #224

Closed akshay-rsm closed 3 years ago

akshay-rsm commented 6 years ago

The API key provided with a Starter account does work when commands are sent to my device in the following format: "pro.arest.io/device_id/mode/5/o?key=your_key" But it also works when sent in the following format, without the API key: "cloud.arest.io/device_id/mode/5/o" Isn't it supposed to be secured through the API key? Or is that a feature provided for Pro accounts only?

marcoschwartz commented 6 years ago

Hi,

It would only work if you are using the API key in your sketch - is that the case? If not, indeed it will connect to aREST unprotected. We'll add a way to use an API key + 'forcing' a device ID into the sketches.

akshay-rsm commented 6 years ago

I am using the API key in my sketch, as shown in the ESP8266_cloud_pro example. I controlled the device without the key initially. I flashed the sketch with the key after registering the device with arest.io. Do you think this might be the issue?

marcoschwartz commented 6 years ago

Hum, we'll need to dive into that - can you send me a message at contact@arest.io with your key so we can have a look?