1

For my latest project I need an api that responds to a 'POST' request by returning json text that depends on the content of the 'POST'.

I have made a version of this in loopback, however I can't think of a good way to secure this API as part of the site (hence my previous question).

I have noticed that there are several joomla extensions that provide API access to a joomla site. Do any of these have capabilities to be customised in the manner I describe above?

5
  • How do you propose securing the API? What do you intend to use to restrict access to said API? Creating an API using a custom controller is simple - you just need to create a new controller, if you haven't already, or extend an existing one, creating a new task. Within said task, you would do your access restriction checks, and sanitise and validate the inputs.
    – Grant G
    Nov 23 '20 at 23:09
  • @Grant_G it doesn't matter how the API is secured, it just needs to be accessable to my registered users and not to the public. Which technology are you referring to when you say it is easy?
    – Huw Evans
    Nov 24 '20 at 9:43
  • 1
    See the docs for controller task - docs.joomla.org/Model-View-Controller/en Since you want to make it accessible to registered users and not to the public, you can simply check the user and return if your checks do not pass. You can see the getUser method documentation here - docs.joomla.org/Accessing_the_current_user_object
    – Grant G
    Nov 24 '20 at 11:48
  • Thank you. That's exactly what I was after (I think). Can you rewrite this as an answer?
    – Huw Evans
    Nov 24 '20 at 11:59
  • No worries. Once you've muddled your way through the docs, feel free to post up here if you get stuck - this is something I have already implemented in a Joomla controller - limited access to registered users of a particular group, anyone else gets a 403. The documentation isn't great, but the code is fairly simple.
    – Grant G
    Nov 24 '20 at 12:17
1

See the docs for controller task - Model View Controller. Since you want to make it accessible to registered users and not to the public, you can simply check the user and return if your checks do not pass. You can see the getUser method documentation here - Accessing Current User Object

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.