Qortal Core - Main Code Repository Decentralized Data Network - Blockchain - TRUE Cross-Chain Trading - Application and Website Hosting - Much More - Qortal is the future internet infrastructure for the global digital world.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

34 lines
449 B

/db*
/lists/
/bin/
/target/
/qortal-backup/
/log.txt.*
/arbitrary*
/Qortal-BTC*
/.factorypath
/.settings*
/.classpath
/.project
/log4j2-test.properties
/.mvn.classpath
/notes*
/settings.json
/testnet*
/settings*.json
/testchain*.json
/run-testnet*.sh
/.idea
/qortal.iml
.DS_Store
/src/main/resources/resources
/*.jar
/run.pid
/run.log
/WindowsInstaller/Install Files/qortal.jar
/*.7z
/tmp
/data*
/src/test/resources/arbitrary/*/.qortal/cache
Rework of API keys An API key is now _required_ for sensitive API calls that would previously have allowed local loopback authentication. Previously, a request would have been considered authenticated if it originated from the same machine, however this creates a security issue when running third party code (particularly javascript) via the data network. The solution is to now require an API key to authenticate sensitive API calls no matter where the request originates from. It works as follows: - When the core is first installed, it has no API key generated and will block sensitive calls until generated. - A new POST /admin/apikey/generate API endpoint has been added, which can be used the generate an API key for a newly installed node. The UI will ultimately call this automatically. - This API returns the generated key so that it can be stored by the requesting app (most likely the UI). - From then on, the generate API requires authentication via the existing API key in order to regenerate a key. It can be used as a security measure if the existing key is compromised. - The API key must be passed to all sensitive API endpoints from then on, even when calling it from the same local machine. - If the core already has a legacy API key specified via the 'apiKey' setting, this will be automatically copied to the new format so that a new one doesn't need to be generated. - The API key itself is stored in a flat file in the qortal directory (the path can be customized using the `apiKeyPath` setting). Deleting this file and restarting the core will allow a new one to be regenerated.
3 years ago
apikey