{"action":"created","issue":{"url":"https://api.github.com/repos/nzbget/nzbget/issues/577","repository_url":"https://api.github.com/repos/nzbget/nzbget","labels_url":"https://api.github.com/repos/nzbget/nzbget/issues/577/labels{/name}","comments_url":"https://api.github.com/repos/nzbget/nzbget/issues/577/comments","events_url":"https://api.github.com/repos/nzbget/nzbget/issues/577/events","html_url":"https://github.com/nzbget/nzbget/issues/577","id":375282186,"node_id":"MDU6SXNzdWUzNzUyODIxODY=","number":577,"title":"API Key support","user":{"login":"rcdailey","id":1768054,"node_id":"MDQ6VXNlcjE3NjgwNTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1768054?v=4","gravatar_id":"","url":"https://api.github.com/users/rcdailey","html_url":"https://github.com/rcdailey","followers_url":"https://api.github.com/users/rcdailey/followers","following_url":"https://api.github.com/users/rcdailey/following{/other_user}","gists_url":"https://api.github.com/users/rcdailey/gists{/gist_id}","starred_url":"https://api.github.com/users/rcdailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcdailey/subscriptions","organizations_url":"https://api.github.com/users/rcdailey/orgs","repos_url":"https://api.github.com/users/rcdailey/repos","events_url":"https://api.github.com/users/rcdailey/events{/privacy}","received_events_url":"https://api.github.com/users/rcdailey/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2018-10-30T01:31:48Z","updated_at":"2018-11-03T17:52:14Z","closed_at":"2018-11-03T17:34:40Z","author_association":"NONE","body":"NZBget needs API key support for its RPC interface. Here is the reason why.\r\n\r\nIn my set up, I use Organizr to run NZBget inside of a tab (iframe). Furthermore, I also have a reverse proxy in front of nzbget that redirects `domain.com/nzbget` to `domain.com/organizr` for authentication. Given this set up, I never allow public access to `domain.com/nzbget` unless they logged in successfully to Organizr. This allows me to completely disable the control user password in NZBget. This means I can access the NZBget web interface via Organizr's iframe without having to log in twice (once in organizr and once again in nzbget itself).\r\n\r\nHowever, I also use an Android app called nzb360. I have to publicly allow access to the nzbget RPC URI's through my reverse proxy, bypassing Organizr authentication in the API case. However, because nzbget does not support API keys, I have to retain the Control user credentials so that outside of my proxy, people can't use the nzbget RPC without a password.\r\n\r\nThis would all be solved if nzbget used API keys for its RPC interface. This would allow me to disable the control user credentials for web interface access, but still keep the RPC secured with a randomly generated API key (similar to how Sonarr's API is secured).\r\n\r\nI have seen [threads](https://forum.nzbget.net/viewtopic.php?t=504) where the author does not express interest in this feature, but I think it's a huge security issue to require HTTP basic auth for an API in a web app. This also has practical limitations, as I explained above.\r\n\r\nPlease add API token authorization of some sort for more flexibility and security."},"comment":{"url":"https://api.github.com/repos/nzbget/nzbget/issues/comments/435607645","html_url":"https://github.com/nzbget/nzbget/issues/577#issuecomment-435607645","issue_url":"https://api.github.com/repos/nzbget/nzbget/issues/577","id":435607645,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTYwNzY0NQ==","user":{"login":"rcdailey","id":1768054,"node_id":"MDQ6VXNlcjE3NjgwNTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1768054?v=4","gravatar_id":"","url":"https://api.github.com/users/rcdailey","html_url":"https://github.com/rcdailey","followers_url":"https://api.github.com/users/rcdailey/followers","following_url":"https://api.github.com/users/rcdailey/following{/other_user}","gists_url":"https://api.github.com/users/rcdailey/gists{/gist_id}","starred_url":"https://api.github.com/users/rcdailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcdailey/subscriptions","organizations_url":"https://api.github.com/users/rcdailey/orgs","repos_url":"https://api.github.com/users/rcdailey/repos","events_url":"https://api.github.com/users/rcdailey/events{/privacy}","received_events_url":"https://api.github.com/users/rcdailey/received_events","type":"User","site_admin":false},"created_at":"2018-11-03T17:52:14Z","updated_at":"2018-11-03T17:52:14Z","author_association":"NONE","body":"Even if I can, I think I shouldn't because since nzbget is in an iframe, the username & password will be exposed on the client side due to the iframe URL"}}
{"actor":{"display_login":"rcdailey"}}