tracking_requests_require_authentication doesn't require authentication for all http APIs

[h-fazai]

For a publicly available Matomo server, where only application users should be able to push events to matomo, there should be some auth mecanism.

So we expect to be able to secure matomo http APIs with requiring auth token, but actually the setting tracking_requests_require_authentication doesn't make token mandatory for all tracking APIs such as the API that sends tracking events (/matomo.php).

Why this use case is not considered by Matomo? otherwise is there any other config to do ?

[sgiehl]

Hi @h-fazai,

Thanks for creating this issue. The tracker is currently always kind of public. Auth tokens are actually not meant to be used that way, as an auth token would also always give at least view access to all reports. They are needed for tracking api only in case you want to e.g. track visits in the past.

To really have a secure way to only allow certain users to track something I guess a more complex mechanism would need to be implemented. As using the token for all users would still allow anyone knowing that token to track anything.

I doubt this is a use case we will be working on soon, but it might be possible to implement that in a custom plugin.

Alternatively you could maybe append a custom tracking parameter to the tracking requests and let the webserver deny all requests that don't contain the parameter or similar.