allow RESTful API accesses (with tokens in QS or POST about kfet HOT 7 CLOSED

And the login tokens must absolutely be linked with the API client that made the authentication !

In fact, you should consider your webui as a client of your API (like I did with Comunic). It makes things much logical and easier after...

from kfet.

How did I not think of that!

Do I link them by IP, by User-Agent string?

(I already consider my webui as a client, just with cookies as a bonus to store the session somewhere; everything will do REST calls and WebSocket accesses)

from kfet.

Make cookies actually carry tokens, like in #16
Sign tokens with a server secret, and store everything inside them, not a db

from kfet.

Yes cookies should carry tokens so you would have to check both API and User tokens before confirming user authentication...

from kfet.

as of 9a07ef5, tokens can be in

• query string GET url?token=<token>
• header Token: <token>
• cookies session=<token>

from kfet.

tokens should be JWT's (#21)

from kfet.

this should have been closed sooner

from kfet.