open/unauth access to api?

[rjadams82]

Does the plugin accept api commands with no api auth?
Based on my tests I can GET /api/currentuser which returns name:null and I can then GET api/plugin/octolight which toggles the plugin and returns current status.

[thomst08]

Hey @rjadams82, that is a good question...
The API part has been there for a while, but your right, there is no check for an API key when querying it...
I will have to look into this and update the code to match with what is recommended with OctoPrint.

Thanks for point that out.

[thomst08]

I have tested the plugin and it 100% accepts API calls with no authentication.
I will look into how this could be improved and alter the API function to keep it protected.

[thomst08]

I have updated OctoLight to version 0.1.8
This now checks for the "Control" permission when an API call is made.
Please check this has corrected the issue your end and this problem should be resolved.

[rjadams82]

Fantastic. I pulled the latest and installed on octoprint 1.9.3
Works as intended. I browse to api/plugin/octolight and received the expected: "error": "You don't have the permission..."

By creating an application key and then simply adding the key in the GET request it works successfully and returns state.
/api/plugin/octolight?apikey=xxxxxxxxxxxxxxxxxxxx

[thomst08]

Excellent, I will close this discussion :)