905672 - mozillians.org REST API should support CORS

Status: NEW

(Participation Infrastructure :: Phonebook, defect)

Description

[Bill Walker [:bwalker] [@wfwalker]]

The phonebook API as documented at https://wiki.mozilla.org/Mozillians/API-Specification should support CORS

Comment 1

[Justin Crawford [:hoosteeno] [:jcrawford]]

This change would allow a variety of new applications of Mozillians data, and is worth serious consideration. Implementing it would require changes to our API access controls. Currently they require an application-specific secret key that grants complete access to mozillians.org data. But if we support client-side applications, we will have to build better ways to guard the data since in that scenario the secret key will be present on every client device. Ideas for this are welcome!

Comment 2

[Andrei Hajdukewycz [:sancus]]

This is a relatively easy change, but as hoosteeno mentioned, we use api keys to restrict access to the api and those obviously can't be distributed to clients.

Our current privacy restrictions for the API make it hard to allow access to clients because the API is intentionally more restricted than the 'vouched mozillian' access level, so we can't simply add username/password authorization or something like that.

Whether we can reduce these restrictions or not depends on what sort of data you're looking to pull for a client side app. We could add public or username/password authorization for certain API functions, though the ones that pull full user data based on search terms are probably off limits, unless you can convince the privacy team to relax these restrictions, I suppose.

Comment 3

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to Andrei Hajdukewycz [:sancus] from comment #2)
> This is a relatively easy change, but as hoosteeno mentioned, we use api
> keys to restrict access to the api and those obviously can't be distributed
> to clients.
> 

Hi Andrei, I agree the current API keys don't seem like a good match for my use case. From the vantage point of building single-page mobile web apps, the ability to access this kind of data from the client is very powerful, so I'd really encourage you to look for a way to enable client-side access to this data.

thanks,
-Bill

Comment 4

[Andrei Hajdukewycz [:sancus]]

It's mostly a policy restriction, not a technical one. We'll have to see if we can get the policy re-evaluated.

Comment 5

[Justin Crawford [:hoosteeno] [:jcrawford]]

:bwalker, could you work with the summit mobile experience team to devise a list of data (or better, endpoints) that you'd like to access on the client? So far I know about...

'Show me all unique cities in Mozillians.org'

I will be glad to open conversations with the privacy and developer teams about the feasibility of creating new endpoints that are either public (if we only need to provide aggregate data such as the above) or authenticated (if we need to provide identifying information).

Comment 6

[Justin Crawford [:hoosteeno] [:jcrawford]]

This is no longer required for the summit experience. Still a good roadmap bug.

Comment 7

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to Justin Crawford [:hoosteeno] from comment #5)
> :bwalker, could you work with the summit mobile experience team to devise a
> list of data (or better, endpoints) that you'd like to access on the client?
> So far I know about...
> 
> 'Show me all unique cities in Mozillians.org'
> 
> I will be glad to open conversations with the privacy and developer teams
> about the feasibility of creating new endpoints that are either public (if
> we only need to provide aggregate data such as the above) or authenticated
> (if we need to provide identifying information).

Justin,

I think we discussed all this in our phone conversation, do you have notes you could paste in here?

Comment 8

[Justin Crawford [:hoosteeno] [:jcrawford]]

We're working on bug 908702 which captures our conversation related to Summit-supporting API endpoints.

Comment 10

[Edwin Wong [:edwong]]

I think as a stop gap - we could have a public data key or give clients a session?