Distinguish between project created via UI v/s created via direct api call

[RishiRajSahu]

Need to add some validation/mechanism to identify the project creation method.

@maxceem @vikasrohit

[vikasrohit]

@maxceem do you have any thought about it?

[maxceem]

@vikasrohit Could you, please, share more context on this.

1. When do we create projects via API in real life?
2. What is the purpose to distinguish these two methods?

[vikasrohit]

1. We have some internal applications which are using connect API for creating projects
2. Purpose is to have better details when debugging some issue e.g. we saw a project with empty title and description on production which is ideally not possible from front end and neither it came from our internal apps. So, we are not sure, if that is actually a bug or someone directly accessed the api.

[maxceem]

@vikasrohit I don't see how can we detect it using data which is already saved in the DB.

Though we can check several things when we get a request.

1. Detect browser.
   In general, we can detect browser using the requests headers like User-Agent. If we call endpoints from the browser, there should be some information. If we call it server side, most likely there would be no User-Agent or some technical one which is put there by the library for request.

   • We can log this information into the console and later check console records.
   • We may also check Referer header to check form which URL such request has been called. We can understand if it has been called from Connect app or other web apps if we have any which are calling create project endpoint. If Referer is not set, this should be a sign for suspicious behavior.

2. Detect server
   If there are many requests which are done by special tools we may want to distinguish if these are legit tools or no.
   If we know the list of our backend services IP addresses, we can log requests which are done from other IP addresses for further research.

3. Applications markers

   • We can add some kind of marker for every our application which is calling this endpoint.
   • We can pass it in the header and later log into the console for debugging.
   • Generally, this special marker could be avoided and we can get this data from the Referer. But in case one application calls project server from both client-side and server-side (which doesn't send referer) we may use such custom marker to detect requests from the same application made client and server side.

[maxceem]

@vikasrohit updated comment above.

[vikasrohit]

Thanks for the input @maxceem. Lets hold for this now.