{"action":"opened","issue":{"url":"https://api.github.com/repos/MPDL-Innovations/spot/issues/399","repository_url":"https://api.github.com/repos/MPDL-Innovations/spot","labels_url":"https://api.github.com/repos/MPDL-Innovations/spot/issues/399/labels{/name}","comments_url":"https://api.github.com/repos/MPDL-Innovations/spot/issues/399/comments","events_url":"https://api.github.com/repos/MPDL-Innovations/spot/issues/399/events","html_url":"https://github.com/MPDL-Innovations/spot/issues/399","id":130975202,"number":399,"title":"APIKey based authentication - clarify the workflow for various scenarios ","user":{"login":"natasab","id":1485258,"avatar_url":"https://avatars.githubusercontent.com/u/1485258?v=3","gravatar_id":"","url":"https://api.github.com/users/natasab","html_url":"https://github.com/natasab","followers_url":"https://api.github.com/users/natasab/followers","following_url":"https://api.github.com/users/natasab/following{/other_user}","gists_url":"https://api.github.com/users/natasab/gists{/gist_id}","starred_url":"https://api.github.com/users/natasab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/natasab/subscriptions","organizations_url":"https://api.github.com/users/natasab/orgs","repos_url":"https://api.github.com/users/natasab/repos","events_url":"https://api.github.com/users/natasab/events{/privacy}","received_events_url":"https://api.github.com/users/natasab/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-03T09:58:34Z","updated_at":"2016-02-03T09:58:34Z","closed_at":null,"body":"At the moment seems that the APIKey based authentication works optimal for MPDLCamera application - which does not implement \"logout\" via REST API:\r\n\r\na) Upon REST login - APIKey is generated (or existing valid APIKey is delivered)\r\nb) MPDLCamera does not support REST Logout, thus APIKey can never be invalidated (unless the 1 year time - as set by default in imeji logic passes)\r\n\r\nCurrent implementation: there is only one valid APIKey for user at the time. Default validity is 1 year.\r\n\r\nWhen multiple REST API clients login with the same user and any of them sends a POST /logout request, the other REST API clients requests will fail - if they use APIKey based authentication (as the key has been invalidated in meantime from one of the clients).\r\n\r\nThis may be a bit problematic, when the REST API clients are running with predefined settings such as configuration for the authentication based on the API Key).\r\n\r\nSo what to advise developers of the REST API clients against imeji API:\r\na) to defer from using the API Key as it can be changed at any time by any other REST API client who can invalidate it by calling /logout method?\r\nb) to defer from using the /logout method ?\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"}}