mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 19:56:48 +00:00
1c60696ea1
The REST API took only the login session, so a script could not use it without a browser. A user now makes API tokens on the profile page (API Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The token is shown once, on a page that is not cached, and then kept only as a SHA-512 digest; the list shows its name, first characters, creation and expiry, and a token is deleted there. Tools send it as "Authorization: Token wvc_...", and act as its user, with that user's permissions. Making and deleting a token is logged, without the token. A password alone (HTTP Basic) still does not reach the API, as it would skip the OTP second factor: a token is made in a session that passed the login and its OTP. The token class comes first, so a refused request gets 401 with its challenge instead of 403. django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the template. |
||
|---|---|---|
| .. | ||
| 0001_initial.py | ||
| 0002_permissionset.py | ||
| 0003_auto_20200604_0930.py | ||
| 0004_auto_20200615_0637.py | ||
| 0005_auto_20200616_1039.py | ||
| 0006_alter_userattributes_id_alter_userinstance_id_and_more.py | ||
| 0007_userattributes_must_change_password.py | ||
| 0008_apply_show_profile_edit_password_once.py | ||
| 0009_api_token.py | ||
| __init__.py | ||