API : Session::init/login +X-XSRF-TOKEN vs USER TOKEN Authorization header (renamed)

[agademer]

Hi everyone,

I'm a bit lost about how the API works.

Last year (Lychee 4.7.1) I had to generate a USER API TOKEN (for cross-site by pass) then login with Session::login and store the authentication in a cookie that I had to give back to all further query Photo::add, etc.
(API TOKEN + Cookie felt a lot but needed)

This year (Lychee 5.1.2) I have observed two weird fact :
1/ USER API TOKEN is sufficient to use Photo::add (no need to login first, no need for cookie)

Ex of working command:
curl --request POST --url MYSITE/api/Photo::add --header 'Accept: application/json' --header 'Content-Type: multipart/form-data' --header 'Authorization: XXXX==' --form albumID="YYYYY" --form file=@source/image.jpg
2/ A user with may_upload=0 can still upload a photo through Photo::add (with the help of the famous API TOKEN).

Given that try to Session::login without API TOKEN does not work (I get the famous "Session expired" answer... not the most explicite error message by the way).

My questions are :

• Is 1/ a normal/wanted behavior ? Should I consider that Session::login / logout are deprecated ?
• Is 2/ a bug that will be solve in the future ? or a normal behavior ?

Thanks in advance for your answers and to the developper to the global great work and animation of the github !

[ildyria]

Is 1/ a normal/wanted behavior ? Should I consider that Session::login / logout are deprecated ?

Yes. with version 5, you should also notice that the buttons for the token, password, U2F etc are moved to a profile page.
This implies that the token are per user.

The code used of the authentication is here:
https://github.com/LycheeOrg/Lychee/blob/master/app/Services/Auth/SessionOrTokenGuard.php#L309

2/ A user with may_upload=0 can still upload a photo through Photo::add (with the help of the famous API TOKEN).

Okay THAT IS A BUG.

(I get the famous "Session expired" answer... not the most explicite error message by the way).

Yeah it is because of the CSRF verification. :|

[ildyria]

I guess you will find something around here:
https://github.com/LycheeOrg/Lychee/blob/master/app/Exceptions/SessionExpiredException.php
https://github.com/LycheeOrg/Lychee/blob/master/app/Exceptions/Handler.php#L215

:)

(If my use case feel weird, know that I use your great app to teach my student how to combine bash script and API 😛 )

Cooool 😲

Note that the example of the generated API document don't indicate the need of the Authorization header.

That's because you can do it another way:

1. query /api/Session::init to get the CSRF token
2. using the CSRF token you can then query api/Session::login with user name and password (you may need to update the XSRF token at every request).
3. Do more queries with the XSRF token now that you are authenticated.

The API token is skipping the CSRF verification and doing Auth at the same time.

[agademer]

Thanks a lot for your answer.

curl --request POST --url https://MYURL/api/Session::init --header 'Accept: application/json' --header 'Content-Type: application/json' --data '{}' --cookie-jar lychee_cookie

I had not seen, but indeed the lychee_cookie file contains a XSRF-TOKEN

But when I try

curl --request POST --url https://MYURL/api/Session::login --header 'Accept: application/json' --header 'Content-Type: application/json' --cookie lychee_cookie --data '{ "username":"agademer", "password":"XXXX"}'

it does not work.

How am I supposed to sent the XSRF token back to the server ?

[ildyria]

As an additional header field. : X-XSRF-TOKEN
Probably

curl --request POST --url https://myurl/api/Session::login --header 'Accept: application/json' --header 'Content-Type: application/json' --header 'X-XSRF-TOKEN: token_value' --cookie lychee_cookie --data '{ "username":"agademer", "password":"XXXX"}'

Do note that the token may have some encoding problems. This is our code in the JS part:

	/**
	 * Returns the value of the XSRF token if it exists in a cookie.
	 *
	 * Inspired by https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#example_2_get_a_sample_cookie_named_test2
	 */
	static get #XsrfToken(): string | null {
		const cookie = document.cookie.split(";").find((row) => /^\s*(X-)?[XC]SRF-TOKEN\s*=/.test(row));
		// We must remove all '%3D' from the end of the string.
		// Background:
		// The actual binary value of the CSFR value is encoded in Base64.
		// If the length of original, binary value is not a multiple of 3 bytes,
		// the encoding gets padded with `=` on the right; i.e. there might be
		// zero, one or two `=` at the end of the encoded value.
		// If the value is sent from the server to the client as part of a cookie,
		// the `=` character is URL-encoded as `%3D`, because `=` is already used
		// to separate a cookie key from its value.
		// When we send back the value to the server as part of an AJAX request,
		// Laravel expects an unpadded value.
		// Hence, we must remove the `%3D`.
		return cookie ? cookie.split("=")[1].trim().replace(/%3D/g, "") : null;
	}

[agademer]

Ok.
What works (for me)

curl --request POST   --url https://MYURL/api/Session::init   --header 'Accept: application/json'   --header 'Content-Type: application/json'   --data '{}' --cookie-jar lychee_cookie -s -o /dev/null
XSRF=$(grep "XSRF-TOKEN" lychee_cookie | cut -f 7 | sed 's:%3D::g')
curl --request POST   --url https://MYURL/api/Session::login   --header 'Accept: application/json'   --header 'Content-Type: application/json'  --header "X-XSRF-TOKEN: $XSRF" --cookie lychee_cookie --cookie-jar lychee_cookie --data '{ "username":"agademer", "password":"XXXX"}'
XSRF=$(grep "XSRF-TOKEN" lychee_cookie | cut -f 7 | sed 's:%3D::g')
curl --request POST   --url https://MYURL/api/Photo::add     --header 'Accept: application/json'   --header 'Content-Type: multipart/form-data' --header "X-XSRF-TOKEN: $XSRF" --cookie lychee_cookie  --form albumID="Eh9tkR6FPYw9DVkYOUCAYPYu" --form [email protected]

1/ Thanks for pointing that I needed to remove the %3D at the end
2/ Note that is after login, the XSRF has changed and I had to : resave the cookie and reextract the token.

I feel that it would be so much simpler (user wise) to reread the info from the cookie.... I don't understand why it's not the case (developer wise) but I image it is complicated 😛 .

For the moment I'll stick with User token. Much easier user wise.
For completion sake, to do exactly the same thing as above, I just need to

curl --request POST --url https://MYURL/api/Photo::add --header 'Accept: application/json' --header 'Content-Type: multipart/form-data' --header 'Authorization: XXX==' --form albumID="Eh9tkR6FPYw9DVkYOUCAYPYu" --form [email protected]

do achieve the same task.