[API] Set pwg_token automatically for api_key requests #2203

New Issue

2026-10-05T01:09:38+02:00

adam commented

2026-10-05 01:09:38 +02:00

Currently in the code we have the following logic:

if (isset($_POST['pwg_token']))
{
  $_POST['pwg_token'] = get_pwg_token();
}

if (isset($_GET['pwg_token']))
{
  $_GET['pwg_token'] = get_pwg_token();
}

When making a request to the Piwigo API using an api_key, if the called method requires a pwg_token, the client must still send a pwg_token parameter in the request. In practice, this means sending something like:

$data['pwg_token'] = 'fake one';

This behavior is not consistent with the API documentation and is not a good practice, since the value of the token does not actually matter in this context.

Since api_key authentication is stateless and not subject to browser CSRF protections, requiring a client to send a dummy pwg_token parameter is unnecessary.

For this reason, we decided to always set the pwg_token automatically when the API is called with a valid api_key. This removes the need for clients to send a fake token.

Currently in the code we have the following logic: ```php if (isset($_POST['pwg_token'])) { $_POST['pwg_token'] = get_pwg_token(); } if (isset($_GET['pwg_token'])) { $_GET['pwg_token'] = get_pwg_token(); } ``` When making a request to the Piwigo API using an `api_key`, if the called method requires a `pwg_token`, the client must still send a `pwg_token` parameter in the request. In practice, this means sending something like: ```php $data['pwg_token'] = 'fake one'; ``` This behavior is not consistent with the API documentation and is not a good practice, since the value of the token does not actually matter in this context. Since `api_key` authentication is stateless and not subject to browser CSRF protections, requiring a client to send a dummy `pwg_token` parameter is unnecessary. For this reason, we decided to always set the `pwg_token` automatically when the API is called with a valid `api_key`. This removes the need for clients to send a fake token.

adam closed this issue

2026-10-05 01:09:38 +02:00

Sign in to join this conversation.

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#2203