1143533 - provide a user information / validator method for api keys

Status: NEW

(Bugzilla :: WebService, enhancement)

Description

[:glob ✱]

for login tokens we have:
http://bugzilla.readthedocs.org/en/latest/api/core/v1/user.html#valid-login

we don't have a corresponding method to check if an api-key is valid, nor is there any method to map from an api-key to a user which would be useful when writing client applications.l

we'd have to be designed it in a way to prevent brute forcing api-keys (like adding a half second delay before each response).

something like:
  /rest/valid_api_key/abcedfgh..56789
  returns user object
  throws exception on invalid

Comment 1

[Kohei Yoshino [:kohei]]

Actually at least the user method returns the 306 error with an appropriate message if an invalid or revoked API key is passed as a query string. BzDeck simply checks if a provided user name and API key are valid using that method, like this:

https://bugzilla.mozilla.org/rest/user?names=[e-mail]&api_key=HppEfUCgAk4FyIEfmW51fXoXU1CFxZ4WxoeqrPXO

(The query string will be replaced with the X-Bugzilla-API-Key soon)

I'm not sure if a dedicated method for that purpose is required but it would be nice to have a document about those errors :)

Comment 2

[Frédéric Buclin]

For security reasons, wouldn't it make more sense to pass both the API key *and* the login name, and check if the API key is valid for that user only? Else you could launch millions of requests concurrently, and your 0.5s delay would be useless.

Comment 3

[David Lawrence [:dkl]]

(In reply to Frédéric Buclin from comment #2)
> For security reasons, wouldn't it make more sense to pass both the API key
> *and* the login name, and check if the API key is valid for that user only?
> Else you could launch millions of requests concurrently, and your 0.5s delay
> would be useless.

I agree as we already do this for the older token verification to make little more secure.

dkl