REST API Token transport

mpbraendle · April 21, 2022, 8:57am

Hi,

can the REST API Token also be sent via HTTP Header instead as a query parameter? I see nothing in the https://docs.pkp.sfu.ca/dev/api/ about this.

Application Version: OJS 3.3.0.10

asmecher · April 21, 2022, 1:24pm

Hi @mpbraendle,

Yes, this was added in OJS 3.3.0-9. see:

github.com/pkp/pkp-lib

Add Authorization header support to API interactions

opened 04:51PM - 08 Feb 22 UTC

closed 01:16AM - 26 Feb 22 UTC

asmecher

Dev Housekeeping

The API's authorization key middleware currently expects an API key specified in… a GET parameter. However, it's more secure and more standard to use an `Authorization:` header. (We already support this in `ArticleHandler` for requests that make use of the API key.) Add support to the API to rely on `Authorization` headers for auth key transmission, and potentially deprecate the `apiToken` request parameter.

Regards,
Alec Smecher
Public Knowledge Project Team