Mercurial > p > roundup > code
comparison doc/rest.txt @ 8175:bd628e64725f
Documentation and fix for REST headers
issue2551372 - Better document necessary headers for REST and fix
logging to log missing Origin header.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Wed, 04 Dec 2024 10:45:26 +0100 |
| parents | 2244205dd7c4 |
| children | d02ce1d14acd |
comparison
equal
deleted
inserted
replaced
| 8174:5ea419c1d571 | 8175:bd628e64725f |
|---|---|
| 66 .. _upgrading directions: upgrading.html | 66 .. _upgrading directions: upgrading.html |
| 67 | 67 |
| 68 Preventing CSRF Attacks | 68 Preventing CSRF Attacks |
| 69 ----------------------- | 69 ----------------------- |
| 70 | 70 |
| 71 Clients should set the header X-REQUESTED-WITH to any value and the | 71 Clients should set the header ``X-REQUESTED-WITH`` to any value and the |
| 72 tracker's config.ini should have ``csrf_enforce_header_x-requested-with | 72 tracker's config.ini should have ``csrf_enforce_header_x-requested-with |
| 73 = yes`` or ``required``. | 73 = yes`` or ``required``. |
| 74 | 74 |
| 75 If you want to allow Roundup's api to be accessed by an application | 75 If you want to allow Roundup's api to be accessed by an application |
| 76 that is not hosted at the same origin as Roundup, you must permit | 76 that is not hosted at the same origin as Roundup, you must permit |
| 77 the origin using the ``allowed_api_origins`` setting in | 77 the origin using the ``allowed_api_origins`` setting in |
| 78 ``config.ini``. | 78 ``config.ini``. |
| 79 | |
| 80 If you access the REST interface with a method other than ``GET``, you | |
| 81 must also supply an origin header with a value that is either the | |
| 82 default origin (the URL of the tracker without the path component set in | |
| 83 the config file as ``web`` in section ``[tracker]``) or one that is | |
| 84 permitted by ``allowed_api_origins``. | |
| 79 | 85 |
| 80 Rate Limiting API Failed Logins | 86 Rate Limiting API Failed Logins |
| 81 ------------------------------- | 87 ------------------------------- |
| 82 | 88 |
| 83 To make brute force password guessing harder, the REST API has an | 89 To make brute force password guessing harder, the REST API has an |