Forum Discussion

Parshant's avatar
Parshant
Boss
7 years ago

Allow and Deny permissions for user roles to use V2 API in browser.

Hi Lithium Team,

Just found it very strange on all over the communities, any type of user role or anonymous can read the users public data in community using V2 API by just hitting this URL (http://community.lithium.com/api/2.0/search?q=SELECT%20login%20from%20users%20where+roles.id%3D%27t%3AAdministrator%27+limit%201000), and there is no way by which community members can disable this from admin or there is any permissions for that. Using this API any user can read usernames of role type(admins) from API URL and can misuse of it.

Even this article(https://community.lithium.com/t5/Developer-Documentation/bd-p/dev-doc-portal?section=commv2&v2.main=gettingstarted#apiBrowser) also states that anonymous users also can read users public data.

There should be set of permissions which can apply for anonymous users to not read users data through API by adding restrictions to API V2.

Attached are some of the screen-shots for this.

  • luk's avatar
    luk
    Boss
    7 years ago

    How exactly would you "misuse" public data that could also be gathered in other ways? Of course, if someone has malicious intentions, it might make targeting specific accounts with brute-force attacks easier, but then the solution is not to cripple the API even more, but to implement proper anti brute-force mechanisms... (for examplein temporary block loginfor x minutes after 5 consecutive wrong login attempts, then even longer after another 5 etc.).

    My point is: There are other ways (besides the API) to figure out the Admin users in a community, e.g. a locked-down API won't really protect you and give a "false " sense of security....

    • Parshant's avatar
      Parshant
      Boss
      7 years ago

      luk, I have just showed example using only login information of the user in the API, but I can see more information.

      See Screenshot for Only First User "Lithium-Admin"

       

       

      • luk's avatar
        luk
        Boss
        7 years ago

        Of course we can, this is called "public information"... =), this was the case with API v1 already, it's information that you could gather in other ways as well...