adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

API does not differentiate invalid username/password from invalid API keys #2109

New Issue
Closed
opened 2026-10-05 01:06:34 +02:00 by adam · 3 comments
adam commented 2026-10-05 01:06:34 +02:00
Owner
Copy link
Copy source

The API method pwg.session.login returns:

  • "stat": "ok", "result": 1 when credentials are correct
  • stat="fail", err = 999, message="Invalid username/password" when credentials are wrong
  • "stat": "ok", "result": 1 when the API keys are correct
  • stat="fail", err = 999, message="Invalid username/password" when API keys are wrong. It should instead return something like stat="fail", err = 998, message="Invalid API keys" so that third party apps can differentiate invalid credentials from invalid API keys.

Could you please fix this in version 16 RC2?

NB: The error code 998 is available.

The API method `pwg.session.login` returns: - `"stat": "ok", "result": 1` when credentials are correct - `stat="fail", err = 999, message="Invalid username/password"` when credentials are wrong - `"stat": "ok", "result": 1` when the API keys are correct - `stat="fail", err = 999, message="Invalid username/password"` when API keys are wrong. It should instead return something like `stat="fail", err = 998, message="Invalid API keys"` so that third party apps can differentiate invalid credentials from invalid API keys. Could you please fix this in version 16 RC2? NB: The error code 998 is available. <!-- github-sync-id:3578099039 -->
adam closed this issue 2026-10-05 01:06:34 +02:00
adam commented 2026-10-05 01:06:35 +02:00
Author
Owner
Copy link
Copy source

We're discussing with @LintyDev about your request. This is not what we had understood during the last meeting.

When 2FA is enabled, when calling pwg.session.login:

  • if the username provided matches an API Key ID pattern "pkid-...", we keep doing as usual
  • if the username is not a "pkid-..." then Piwigo responds with a new error code and a translated error "2FA is enabled. Use an API Key." without redirecting.

I don't see the added value to tell the user "invalid API key" when using this "trick" to use an API key ID/secret as username/password in pwg.session.login.

Another different case is when you use the API key in the "authorization" header, then yes you need a specific error code. But that's another story compared to the trick of using an API Key on pwg.session.login.

We're discussing with @LintyDev about your request. This is not what we had understood during the last meeting. When 2FA is enabled, when calling `pwg.session.login`: - if the username provided matches an API Key ID pattern "pkid-...", we keep doing as usual - if the username is not a "pkid-..." then Piwigo responds with a new error code and a translated error "2FA is enabled. Use an API Key." without redirecting. I don't see the added value to tell the user "invalid API key" when using this "trick" to use an API key ID/secret as username/password in `pwg.session.login`. Another different case is when you use the API key in the "authorization" header, then yes you need a specific error code. But that's another story compared to the trick of using an API Key on `pwg.session.login`. <!-- github-comment-id:3481165379 -->
adam commented 2026-10-05 01:06:35 +02:00
Author
Owner
Copy link
Copy source

Yes, we did not discuss this in the meeting. But I then realised that we had no mechanism for informing a third party app that 2FA is enabled.

So I came with this idea which is compatible with current third party apps, which better informs the user and which is a way to inform the app that 2FA is enabled and that the app should proceed further i.e. ask for the 2FA method, etc.

Yes, we did not discuss this in the meeting. But I then realised that we had no mechanism for informing a third party app that 2FA is enabled. So I came with this idea which is compatible with current third party apps, which better informs the user and which is a way to inform the app that 2FA is enabled and that the app should proceed further i.e. ask for the 2FA method, etc. <!-- github-comment-id:3481637287 -->
adam commented 2026-10-05 01:06:36 +02:00
Author
Owner
Copy link
Copy source

This is already the case; we have an appropriate response when the user logs in with their credentials via the API but 2FA is enabled. https://github.com/Piwigo/piwigo-two_factor/blob/21a7ec047eed71bb1f8a5b233842ac6c2caab0a9/includes/events.inc.php#L70

This is already the case; we have an appropriate response when the user logs in with their credentials via the API but 2FA is enabled. https://github.com/Piwigo/piwigo-two_factor/blob/21a7ec047eed71bb1f8a5b233842ac6c2caab0a9/includes/events.inc.php#L70 <!-- github-comment-id:3490083064 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2109