adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Request for API method providing api_key_forbidden_methods #2122

New Issue
Open
opened 2026-10-05 01:06:57 +02:00 by adam · 2 comments
adam commented 2026-10-05 01:06:57 +02:00
Owner
Copy link
Copy source

Since the introduction of the API keys, $conf['api_key_forbidden_methods'] is used to select API methods that should not be called with API keys for security reasons.

Today, there is no API method allowing to retrieve the list of api_key_forbidden_methods and third party apps do not know for which methods they should ask credentials (with 2FA or not) to the user before performing the request.

Could you provide a way to retrieve the list of api_key_forbidden_methods? This could be done with the reflection.getMethodList method returning extra data (my preferred solution) or with the reflection.getMethodDetails method returning an option telling that the use of API keys is forbidden.

Since the introduction of the API keys, `$conf['api_key_forbidden_methods']` is used to select API methods that should not be called with API keys for security reasons. Today, there is no API method allowing to retrieve the list of `api_key_forbidden_methods` and third party apps do not know for which methods they should ask credentials (with 2FA or not) to the user before performing the request. Could you provide a way to retrieve the list of `api_key_forbidden_methods`? This could be done with the `reflection.getMethodList` method returning extra data (my preferred solution) or with the `reflection.getMethodDetails` method returning an option telling that the use of API keys is forbidden. <!-- github-sync-id:3628616615 -->
adam commented 2026-10-05 01:06:58 +02:00
Author
Owner
Copy link
Copy source

Why wouldn't we remove the list of forbidden methods from the output of reflection.getMethodList ?

Why wouldn't we remove the list of forbidden methods from the output of `reflection.getMethodList` ? <!-- github-comment-id:3542552447 -->
adam commented 2026-10-05 01:06:59 +02:00
Author
Owner
Copy link
Copy source

Mobile apps being mostly used by administrators, we must allow them to use the API Key prohibited methods, for example via 2FA access.

Mobile apps being mostly used by administrators, we must allow them to use the API Key prohibited methods, for example via 2FA access. <!-- github-comment-id:3543066006 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2122