adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

pwg.images.uploadAsync not working with API keys #2114

New Issue
Open
opened 2026-10-05 01:06:42 +02:00 by adam · 7 comments
adam commented 2026-10-05 01:06:42 +02:00
Owner
Copy link
Copy source

The API method pwg.images.uploadAsync returns the error 999 (Invalid username/password) when the username and password are replaced with the API public and secret keys introduced with Piwigo 16. Adding the HTTP header "Authorization" does not help.

Is this a bug or should I proceed differently?

The API method `pwg.images.uploadAsync` returns the error 999 (Invalid username/password) when the username and password are replaced with the API public and secret keys introduced with Piwigo 16. Adding the HTTP header "Authorization" does not help. Is this a bug or should I proceed differently? <!-- github-sync-id:3611624753 -->
adam commented 2026-10-05 01:06:43 +02:00
Author
Owner
Copy link
Copy source

What if you don't provide username/password and only http header Authorization ?

What if you don't provide username/password and only http header `Authorization` ? <!-- github-comment-id:3516302802 -->
adam commented 2026-10-05 01:06:44 +02:00
Author
Owner
Copy link
Copy source

I reproduce the problem. The test of preg_match('/^pkid-\d{8}-[a-z0-9]{20}$/i', $params['username']) is only in pwg.session.login. @LintyDev will fix that :-)

Question it raises : what if the API client provides both header Authorization and username/password?

I reproduce the problem. The test of `preg_match('/^pkid-\d{8}-[a-z0-9]{20}$/i', $params['username'])` is only in `pwg.session.login`. @LintyDev will fix that :-) Question it raises : what if the API client provides both header `Authorization` and username/password? <!-- github-comment-id:3516414869 -->
adam commented 2026-10-05 01:06:44 +02:00
Author
Owner
Copy link
Copy source

I get the error 1002 "Missing parameters: username" if I only use the HTTP header Authorization.
Thanks

I get the error 1002 "Missing parameters: username" if I only use the HTTP header `Authorization.` Thanks <!-- github-comment-id:3516440191 -->
adam commented 2026-10-05 01:06:45 +02:00
Author
Owner
Copy link
Copy source

With this fix, pwg.images.uploadAsync returns a HTTP Authentication error 401 when called with wrong API keys.

As for other API methods, it should instead return a HTTP 200 status code (the communication went well) and an API error telling that the keys are invalid.

With this fix, `pwg.images.uploadAsync` returns a HTTP Authentication error 401 when called with wrong API keys. As for other API methods, it should instead return a HTTP 200 status code (the communication went well) and an API error telling that the keys are invalid. <!-- github-comment-id:3650741312 -->
adam commented 2026-10-05 01:06:46 +02:00
Author
Owner
Copy link
Copy source

Please correct the error returned when API key are revoked or invalid.

Please correct the error returned when API key are revoked or invalid. <!-- github-comment-id:3671081615 -->
adam commented 2026-10-05 01:06:46 +02:00
Author
Owner
Copy link
Copy source

With this fix, pwg.images.uploadAsync returns a HTTP Authentication error 401 when called with wrong API keys.

As for other API methods, it should instead return a HTTP 200 status code (the communication went well) and an API error telling that the keys are invalid.

I will discuss this with plg, because in my opinion, an API key error should never return a 200 status response

> With this fix, `pwg.images.uploadAsync` returns a HTTP Authentication error 401 when called with wrong API keys. > > As for other API methods, it should instead return a HTTP 200 status code (the communication went well) and an API error telling that the keys are invalid. I will discuss this with plg, because in my opinion, an API key error should never return a 200 status response <!-- github-comment-id:3671098506 -->
adam commented 2026-10-05 01:06:47 +02:00
Author
Owner
Copy link
Copy source

Until the introduction of the API keys, HTTP and Piwigo errors were always differentiated. For example, when credentials are wrong (username/password or API keys), Piwigo returns an error 999, not a HTTP Error 401. So please do not change the way errors are managed.

Until the introduction of the API keys, HTTP and Piwigo errors were always differentiated. For example, when credentials are wrong (username/password or API keys), Piwigo returns an error 999, not a HTTP Error 401. So please do not change the way errors are managed. <!-- github-comment-id:3671149679 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2114