New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JSONP support for API #1700

Closed
spliznork opened this Issue Feb 6, 2014 · 4 comments

Comments

Projects
None yet
2 participants
@spliznork

spliznork commented Feb 6, 2014

Would be nice to have JSONP support in the API interface. This would allow an external status page, for instance, to query a pool's API without having to go through a proxy.

Adding JSONP support could be implemented as a small modification to get_json in api.class.php, perhaps like this

  function get_json($data, $force=false) {
    $json = json_encode(...); /* original get_json call to json_encode here */
    if ($_REQUEST['callback']) {
      return $_REQUEST['callback'] . '(' . $json . ');';
    }
    return $json;
  }
@TheSerapher

This comment has been minimized.

Show comment
Hide comment
@TheSerapher

TheSerapher Feb 6, 2014

Contributor

What are the security and potential DoS implications by adding jsonp?

Contributor

TheSerapher commented Feb 6, 2014

What are the security and potential DoS implications by adding jsonp?

@TheSerapher

This comment has been minimized.

Show comment
Hide comment
@TheSerapher

TheSerapher Feb 6, 2014

Contributor

I just remembered we had this request earlier and it was rejected for security reasons.

If you need this still you can enable it via adding a custom header allowing your cross security policy to deliver requests to other domains.

This is IMHO a better solution than just opening it up. Especially if people don't know what this means.

Contributor

TheSerapher commented Feb 6, 2014

I just remembered we had this request earlier and it was rejected for security reasons.

If you need this still you can enable it via adding a custom header allowing your cross security policy to deliver requests to other domains.

This is IMHO a better solution than just opening it up. Especially if people don't know what this means.

@TheSerapher TheSerapher closed this Feb 6, 2014

@spliznork

This comment has been minimized.

Show comment
Hide comment
@spliznork

spliznork Feb 6, 2014

In response to your first question, the way JSONP works, it issues a request against the server by injecting a <script src="..."></script> tag in the HTML. The client then attempts to execute the response.

So, JSONP has security concerns for the client making the request -- the client executes the response from the server as Javascript without having the opportunity to validate it as (only a) valid a JSON data object. But, JSONP introduces no new security concerns for the server.

The potential for DoS is also unaffected by JSONP. A client can inject that script tag to issue a GET request against the server regardless if the server is expected to return JSON or JSONP. For instance, a web client can query on any method in the current API, the server will correctly process the query and return a valid JSON response, which the client will try to execute as Javascript. Without the JSONP callback, the client will fail to parse the response. But, the impact and load on the server is the same either way.

CORS gives the client an opportunity to validate the response, which resolves the client security concern. But, that's it's only advantage in this context.

I kindly ask that you reconsider :). Thank you!

spliznork commented Feb 6, 2014

In response to your first question, the way JSONP works, it issues a request against the server by injecting a <script src="..."></script> tag in the HTML. The client then attempts to execute the response.

So, JSONP has security concerns for the client making the request -- the client executes the response from the server as Javascript without having the opportunity to validate it as (only a) valid a JSON data object. But, JSONP introduces no new security concerns for the server.

The potential for DoS is also unaffected by JSONP. A client can inject that script tag to issue a GET request against the server regardless if the server is expected to return JSON or JSONP. For instance, a web client can query on any method in the current API, the server will correctly process the query and return a valid JSON response, which the client will try to execute as Javascript. Without the JSONP callback, the client will fail to parse the response. But, the impact and load on the server is the same either way.

CORS gives the client an opportunity to validate the response, which resolves the client security concern. But, that's it's only advantage in this context.

I kindly ask that you reconsider :). Thank you!

@TheSerapher

This comment has been minimized.

Show comment
Hide comment
@TheSerapher

TheSerapher Feb 7, 2014

Contributor

Excellent :) Good explanation too! If your suggested change is the only thing required we can surely add it.

Contributor

TheSerapher commented Feb 7, 2014

Excellent :) Good explanation too! If your suggested change is the only thing required we can surely add it.

@TheSerapher TheSerapher reopened this Feb 7, 2014

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment