1139755 - Allow API authentication with X-Headers

Status: RESOLVED FIXED

(Bugzilla :: WebService, enhancement)

Description

[Justin Wood (:Callek)]

Would be great to allow Authentication in GET requests via something other than url-params.

(the URL-params issue has been the root cause of a sec bug I'm dealing with right now)

While API-Key login for the API exists, it still can get exposed in some apache logs or client software error messages.

I propose we allow Http headers to do the login, such as:

Header:
X-Bugzilla-API-Key: <>

If present we use that... etc.

Comment 1

[:glob ✱]

Attachment: 1139755_1.patch

- adds x-header auth support for login, password, api-key, and token
- limited to REST and JSONRPC only

Comment 2

[David Lawrence [:dkl]]

Comment on attachment 8573717 [details] [diff] [review]
1139755_1.patch

Review of attachment 8573717 [details] [diff] [review]:
-----------------------------------------------------------------

Works as expected and looks good to me. r=dkl

Comment 3

[:glob ✱]

To ssh://[e-mail]/bugzilla/bugzilla.git
   243d66a..de0781f  master -> master


for the docs http://bugzilla.readthedocs.org/en/latest/api/core/v1/general.html#authentication :
--8<--
Alternatively authentication credentials can be provided via one of the following X-Headers:
  X-BUGZILLA-LOGIN
  X-BUGZILLA-PASSWORD
  X-BUGZILLA-API-KEY
  X-BUGZILLA-TOKEN

Credentials passed as part of the query string take precedence over X-header credentials.
--8<--

Comment 4

[:glob ✱]

Fix 'Use of uninitialized value' warning

To ssh://[e-mail]/bugzilla/bugzilla.git
   de0781f..1f54136  master -> master

Comment 5

[Frédéric Buclin]

(In reply to Byron Jones ‹:glob› (Unavailable until 4th Jan) from comment #3)
> for the docs
> http://bugzilla.readthedocs.org/en/latest/api/core/v1/general.
> html#authentication :
> --8<--
> Alternatively authentication credentials can be provided via one of the
> following X-Headers:
>   X-BUGZILLA-LOGIN
>   X-BUGZILLA-PASSWORD
>   X-BUGZILLA-API-KEY
>   X-BUGZILLA-TOKEN
> 
> Credentials passed as part of the query string take precedence over X-header
> credentials.
> --8<--

To ssh://[e-mail]/bugzilla/bugzilla.git
   c80aed6..cd52bd0  master -> master