0

So the X-Joomla-Token with the API Key is added to the Request Header upon starting a request. I have a partner that needs to access the API but is due to his infrastructure not able to add the Token to the Header.

Is it possible to add the Token to the query params like this:

https://www.mysite.com/api/index.php/v1/app/service?a=1&X-Joomla-Token=497562347562347562394756475623475634890756

I tested that with Postman, but it seems Joomla is not capable of processing that because i get an 401.

Improve this question

1 Answer 1

Reset to default
0

Sending sensitive data as query parameter is extremely insecure. Token plugin does not and will not support this. If you really need this, you have to write your own API authentication plugin. The principle is the same as standard authentication plugin, except it belongs to api-authentication group.

Improve this answer
1
  • It's not sensitive, as the API access delivers only public information and is limited to a registered user group with limited rights. I have tried to use the basic authentication plugin for api authentication, but every access gets redirected to standard url and fails. Will probably open a separate question for it.
    – maidan
    Commented Jan 5 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.