3

I have created a couple of web services under Joomla 4 that are simple enough calls to the same website to refresh a couple of fields when something else changes. In my JS code I have the 'X-Joomla-Token' along with my API token of the Super User. All works fine.

As the function is currently on a development/test machine and only visible to Registered users the risk of any security exposure is minimal however my concern is what happens if/when I need to have a public facing web service API and my Super User API token is visible to any hack that can use their browsers developers tools to find the token and cut/paste my super users token into their own code or service like Postman and create themselves a new Super User account or delete content using the core endpoints.

I understand that in the future web services wont be limited to using Super User accounts token and users/token with a lower level of access should be able to be used therefore is it a bit early to have publicly accessible API's with Joomla?

Are there approaches to hide or obfuscate the token so that it can't be used by others for their own naughtiness or do I need to wait until limited user/tokens are available to manage access to public endpoints?

Improve this question

1 Answer 1

Reset to default
2

With a Joomla API token, you can get, create, delete and update pretty much anything on the site, including the application configuration.

I have created a couple of web services under Joomla 4 that are simple enough calls to the same website to refresh a couple of fields when something else change.

Now, let's say I visit your website, register an account, inspect the source code, and see your API token. I could create myself a super admin account, remove you as a user or simply destroy your site.

You need to ensure that all API calls are done server-side, so that the token is not exposed and your only fetch data, rather than allowing people to create, update and delete.

Improve this answer
2
  • 1
    Thank you for taking the time to answer. What you describe is the issue that I can see and doing server side calls might be the only way to handle actions from a page with public view until we can use tokens not connected to Super Users that can be limited to read only functions. In my current use I am using JS to make the API call in response to a Barcode reader thus waiting for page reload to make a server side request each scan would slow down the process too much. Are you aware when the restriction of only working with Super User API tokens will be removed?
    – Irata ♦
    Commented Mar 10, 2022 at 9:43
  • So there's no way to encrypt the API key? Joomla won't accept this?
    – Eoin
    Commented Sep 3 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.