{"action":"created","issue":{"url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/158","repository_url":"https://api.github.com/repos/sensebox/openSenseMap-API","labels_url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/158/labels{/name}","comments_url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/158/comments","events_url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/158/events","html_url":"https://github.com/sensebox/openSenseMap-API/issues/158","id":310728438,"node_id":"MDU6SXNzdWUzMTA3Mjg0Mzg=","number":158,"title":"Authentication on Measurement Upload","user":{"login":"nobodyinperson","id":19148271,"node_id":"MDQ6VXNlcjE5MTQ4Mjcx","avatar_url":"https://avatars0.githubusercontent.com/u/19148271?v=4","gravatar_id":"","url":"https://api.github.com/users/nobodyinperson","html_url":"https://github.com/nobodyinperson","followers_url":"https://api.github.com/users/nobodyinperson/followers","following_url":"https://api.github.com/users/nobodyinperson/following{/other_user}","gists_url":"https://api.github.com/users/nobodyinperson/gists{/gist_id}","starred_url":"https://api.github.com/users/nobodyinperson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nobodyinperson/subscriptions","organizations_url":"https://api.github.com/users/nobodyinperson/orgs","repos_url":"https://api.github.com/users/nobodyinperson/repos","events_url":"https://api.github.com/users/nobodyinperson/events{/privacy}","received_events_url":"https://api.github.com/users/nobodyinperson/received_events","type":"User","site_admin":false},"labels":[{"id":954059312,"node_id":"MDU6TGFiZWw5NTQwNTkzMTI=","url":"https://api.github.com/repos/sensebox/openSenseMap-API/labels/v6","name":"v6","color":"e29a6c","default":false}],"state":"open","locked":false,"assignee":{"login":"mpfeil","id":2471172,"node_id":"MDQ6VXNlcjI0NzExNzI=","avatar_url":"https://avatars3.githubusercontent.com/u/2471172?v=4","gravatar_id":"","url":"https://api.github.com/users/mpfeil","html_url":"https://github.com/mpfeil","followers_url":"https://api.github.com/users/mpfeil/followers","following_url":"https://api.github.com/users/mpfeil/following{/other_user}","gists_url":"https://api.github.com/users/mpfeil/gists{/gist_id}","starred_url":"https://api.github.com/users/mpfeil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpfeil/subscriptions","organizations_url":"https://api.github.com/users/mpfeil/orgs","repos_url":"https://api.github.com/users/mpfeil/repos","events_url":"https://api.github.com/users/mpfeil/events{/privacy}","received_events_url":"https://api.github.com/users/mpfeil/received_events","type":"User","site_admin":false},"assignees":[{"login":"mpfeil","id":2471172,"node_id":"MDQ6VXNlcjI0NzExNzI=","avatar_url":"https://avatars3.githubusercontent.com/u/2471172?v=4","gravatar_id":"","url":"https://api.github.com/users/mpfeil","html_url":"https://github.com/mpfeil","followers_url":"https://api.github.com/users/mpfeil/followers","following_url":"https://api.github.com/users/mpfeil/following{/other_user}","gists_url":"https://api.github.com/users/mpfeil/gists{/gist_id}","starred_url":"https://api.github.com/users/mpfeil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpfeil/subscriptions","organizations_url":"https://api.github.com/users/mpfeil/orgs","repos_url":"https://api.github.com/users/mpfeil/repos","events_url":"https://api.github.com/users/mpfeil/events{/privacy}","received_events_url":"https://api.github.com/users/mpfeil/received_events","type":"User","site_admin":false}],"milestone":null,"comments":10,"created_at":"2018-04-03T07:44:47Z","updated_at":"2018-09-17T09:02:46Z","closed_at":null,"author_association":"NONE","body":"<!--- Provide a general summary of the issue in the Title above -->\r\n\r\nWhen uploading new measurement data via the API HTTP POST method (according to the docs at https://docs.opensensemap.org/#api-Measurements-postNewMeasurement) there is no authentication that authorizes the uploader to do so. At least for my custom test box that I created via the openSenseMap web interface this results in **anyone** being able to upload arbitrary measurement data to **my** box via a simple\r\n\r\n```bash\r\ncurl \\\r\n    -H \"Content-Type: application/json\" \\\r\n    -d '{\"value\":\"3333\"}' \\\r\n    https://api.opensensemap.org/boxes/$SENSEBOX_ID/$SENSOR_ID\r\n```\r\n\r\nwhere `$SENSEBOX_ID` and `$SENSOR_ID` are publicly available, e.g. via the openSenseMap web interface.\r\n\r\nWhile of course the whole openSenseMap project is based on nice people collaborating and feeding an awesome measurement network together, \"trust is good, control is better\", I would say. :-)\r\n\r\n## Expected Behavior\r\n\r\nThe _new Measurement_ HTTP POST API method should require a mean of authentication.\r\n\r\n<!--- If you're describing a bug, tell us what should happen -->\r\n<!--- If you're suggesting a change/improvement, tell us how it should work -->\r\n\r\n## Current Behavior\r\n\r\nThe _new Measurement_ HTTP POST API method does not require a mean of authentication.\r\n\r\n<!--- If describing a bug, tell us what happens instead of the expected behavior -->\r\n<!--- If suggesting a change/improvement, explain the difference from current behavior -->\r\n\r\n## Possible solution\r\n\r\nI understand that introducing an authentication to the upload mechanism increases the complexity of the sensor software. A solution could be to add an option for _upload only with authentication_ to the senseBox which forces the upload to happen with authentication, e.g. with the standard header-based authentication with the JSON Web Token. Maybe even via another API method.\r\n\r\n## Your Environment\r\n<!--- Include as many relevant details about the environment you experienced the bug in -->\r\n\r\n* Operating System and version: XUbuntu 16.04\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/comments/421935498","html_url":"https://github.com/sensebox/openSenseMap-API/issues/158#issuecomment-421935498","issue_url":"https://api.github.com/repos/sensebox/openSenseMap-API/issues/158","id":421935498,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTkzNTQ5OA==","user":{"login":"nobodyinperson","id":19148271,"node_id":"MDQ6VXNlcjE5MTQ4Mjcx","avatar_url":"https://avatars0.githubusercontent.com/u/19148271?v=4","gravatar_id":"","url":"https://api.github.com/users/nobodyinperson","html_url":"https://github.com/nobodyinperson","followers_url":"https://api.github.com/users/nobodyinperson/followers","following_url":"https://api.github.com/users/nobodyinperson/following{/other_user}","gists_url":"https://api.github.com/users/nobodyinperson/gists{/gist_id}","starred_url":"https://api.github.com/users/nobodyinperson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nobodyinperson/subscriptions","organizations_url":"https://api.github.com/users/nobodyinperson/orgs","repos_url":"https://api.github.com/users/nobodyinperson/repos","events_url":"https://api.github.com/users/nobodyinperson/events{/privacy}","received_events_url":"https://api.github.com/users/nobodyinperson/received_events","type":"User","site_admin":false},"created_at":"2018-09-17T09:02:46Z","updated_at":"2018-09-17T09:02:46Z","author_association":"NONE","body":"When the project is ready, I will make it public so you can access it too."}}
{"actor":{"display_login":"nobodyinperson"}}