Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Section


Column
width30%

Burti API can and should be configured to require a secret token for all transactions. Consider this a password. Usage of the API without a token should be limited to testing environments only.

The setting for this can be found in the "Burti - JSON API" module.

Note

Tokens sent over a HTTP connection can easily be intercepted and stolen (as well as all other data sent along with it).



Column
width70%


Custom security via HAL

Section


Column
width30%

Burti API allows you to implement additional layers and logic to control who and how can access the API as a whole or separately for its' endpoints. As us for more details on how to do it, as this is an advanced topic and will require HAL programming.

This is done using the field "Custom boolean auth.function" on each relevant interface definition record, found in the "Burti - JSON API" module.

The function can be as simple as a username/password check that is passed along additionally with the request or as complex as calculating and validating against a passed hash of the request by a pre-determined algorithm.


Column
width70%

Image Added


Interface generation

Read API

...