X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=doc%2Fmd%2FREST-API.md;h=01071d8e550775d7836d99a6129ca5871a7a3d27;hb=91a21c272960889afd4eaa431a3d29b7785b6efc;hp=68a83c00a9b801c9c97679710e73c1cd5055ec00;hpb=ecda1e0ace4a8bf0f852820e02695e0fd8c68359;p=github%2Fshaarli%2FShaarli.git

diff --git a/doc/md/REST-API.md b/doc/md/REST-API.md
index 68a83c00..01071d8e 100644
--- a/doc/md/REST-API.md
+++ b/doc/md/REST-API.md
@@ -1,42 +1,86 @@
-## Usage and Prerequisites
+# REST API
 
-See the [REST API documentation](http://shaarli.github.io/api-documentation/)
-for a list of available endpoints and parameters.
+## Server requirements
 
-Please ensure that your server meets the [requirements](Server-requirements)
-and is properly [configured](Server-configuration):
+See the **[REST API documentation](http://shaarli.github.io/api-documentation/)** for a list of available endpoints and parameters.
+
+Please ensure that your server meets the requirements and is properly [configured](Server-configuration):
 
 - URL rewriting is enabled (see specific Apache and Nginx sections)
 - the server's timezone is properly defined
-- the server's clock is synchronized with
-  [NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol)
+- the server's clock is synchronized with [NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol)
 
-The host where the API client is invoked should also be synchronized with NTP,
-see [token expiration](#payload).
+The host where the API client is invoked should also be synchronized with NTP, see _payload/token expiration_
 
-## Authentication
 
-All requests to Shaarli's API must include a JWT token to verify their authenticity.
+## Clients and examples
 
-This token has to be included as an HTTP header called `Authentication: Bearer <jwt token>`.
+- **[python-shaarli-client](https://github.com/shaarli/python-shaarli-client)** - the reference API client ([Documentation](http://python-shaarli-client.readthedocs.io/en/latest/))
+- [shaarli-client](https://www.npmjs.com/package/shaarli-client) - NodeJs client ([source code](https://github.com/laBecasse/shaarli-client)) by [laBecasse](https://github.com/laBecasse)
+- [Android client example with Kotlin](https://gitlab.com/snippets/1665808) by [Braincoke](https://github.com/Braincoke)
 
-JWT resources :
 
-- [jwt.io](https://jwt.io) (including a list of client per language).
-- RFC : https://tools.ietf.org/html/rfc7519
-- https://float-middle.com/json-web-tokens-jwt-vs-sessions/
-- HackerNews thread: https://news.ycombinator.com/item?id=11929267
+This example uses the [PHP cURL](http://php.net/manual/en/book.curl.php) library.
 
+```php
+<?php
+$baseUrl = 'https://shaarli.mydomain.net';
+$secret = 'thats_my_api_secret';
+
+function base64url_encode($data) {
+  return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
+}
 
-### Shaarli JWT Token
+function generateToken($secret) {
+    $header = base64url_encode('{
+        "typ": "JWT",
+        "alg": "HS512"
+    }');
+    $payload = base64url_encode('{
+        "iat": '. time() .'
+    }');
+    $signature = base64url_encode(hash_hmac('sha512', $header .'.'. $payload , $secret, true));
+    return $header . '.' . $payload . '.' . $signature;
+}
 
-JWT tokens are composed by three parts, separated by a dot `.` and encoded in base64:
+
+function getInfo($baseUrl, $secret) {
+    $token = generateToken($secret);
+    $endpoint = rtrim($baseUrl, '/') . '/api/v1/info';
+
+    $headers = [
+        'Content-Type: text/plain; charset=UTF-8',
+        'Authorization: Bearer ' . $token,
+    ];
+
+    $ch = curl_init($endpoint);
+    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
+    curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
+
+    $result = curl_exec($ch);
+    curl_close($ch);
+
+    return $result;
+}
+
+var_dump(getInfo($baseUrl, $secret));
+```
+
+## Implementation
+
+### Authentication
+
+- All requests to Shaarli's API must include a **JWT token** to verify their authenticity.
+- This token must be included as an HTTP header called `Authentication: Bearer <jwt token>`.
+- JWT tokens are composed by three parts, separated by a dot `.` and encoded in base64:
 
 ```
 [header].[payload].[signature]
 ```
 
-#### Header
+##### Header
 
 Shaarli only allow one hash algorithm, so the header will always be the same:
 
@@ -53,13 +97,9 @@ Encoded in base64, it gives:
 ewogICAgICAgICJ0eXAiOiAiSldUIiwKICAgICAgICAiYWxnIjogIkhTNTEyIgogICAgfQ==
 ```
 
-#### Payload
-
-**Token expiration**
+##### Payload
 
-To avoid infinite token validity, JWT tokens must include their creation date
-in UNIX timestamp format (timezone independent - UTC) under the key `iat` (issued at).
-This token will be valid during **9 minutes**.
+Token expiration: To avoid infinite token validity, JWT tokens must include their creation date in UNIX timestamp format (timezone independent - UTC) under the key `iat` (issued at) field ([1](https://tools.ietf.org/html/rfc7519#section-4.1.6)). This token will be valid during **9 minutes**.
 
 ```json
 {
@@ -67,14 +107,11 @@ This token will be valid during **9 minutes**.
 }
 ```
 
-See [RFC reference](https://tools.ietf.org/html/rfc7519#section-4.1.6).
+##### Signature
 
+The signature authenticates the token validity. It contains the base64 of the header and the body, separated by a dot `.`, hashed in SHA512 with the API secret available in Shaarli administration page.
 
-#### Signature
-
-The signature authenticate the token validity. It contains the base64 of the header and the body, separated by a dot `.`, hashed in SHA512 with the API secret available in Shaarli administration page.
-
-Signature example with PHP:
+Example signature with PHP:
 
 ```php
 $content = base64_encode($header) . '.' . base64_encode($payload);
@@ -82,72 +119,32 @@ $signature = hash_hmac('sha512', $content, $secret);
 ```
 
 
-## Clients and examples
-### Android, Java, Kotlin
 
-- [Android client example with Kotlin](https://gitlab.com/snippets/1665808)
-  by [Braincoke](https://github.com/Braincoke)
+## Troubleshooting
 
-### Javascript, NodeJS
+### Debug mode
 
-- [shaarli-client](https://www.npmjs.com/package/shaarli-client)
-  ([source code](https://github.com/laBecasse/shaarli-client))
-  by [laBecasse](https://github.com/laBecasse)
+> This should never be used in a production environment.
 
-### PHP
+For security reasons, authentication issues will always return an `HTTP 401` error code without any detail.
 
-This example uses the [PHP cURL](http://php.net/manual/en/book.curl.php) library.
-
-```php
-<?php
-$baseUrl = 'https://shaarli.mydomain.net';
-$secret = 'thats_my_api_secret';
-
-function base64url_encode($data) {
-  return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
-}
+It is possible to enable the debug mode in `config.json.php` 
+to get the actual error message in the HTTP response body with:
 
-function generateToken($secret) {
-    $header = base64url_encode('{
-        "typ": "JWT",
-        "alg": "HS512"
-    }');
-    $payload = base64url_encode('{
-        "iat": '. time() .'
-    }');
-    $signature = base64url_encode(hash_hmac('sha512', $header .'.'. $payload , $secret, true));
-    return $header . '.' . $payload . '.' . $signature;
+```json
+{
+  "dev": {
+    "debug": true
+  }
 }
+```
 
+## References
 
-function getInfo($baseUrl, $secret) {
-    $token = generateToken($secret);
-    $endpoint = rtrim($baseUrl, '/') . '/api/v1/info';
-
-    $headers = [
-        'Content-Type: text/plain; charset=UTF-8',
-        'Authorization: Bearer ' . $token,
-    ];
-
-    $ch = curl_init($endpoint);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
-    curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
-
-    $result = curl_exec($ch);
-    curl_close($ch);
-
-    return $result;
-}
-
-var_dump(getInfo($baseUrl, $secret));
-```
+- [jwt.io](https://jwt.io) (including a list of client per language).
+- [RFC - JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519)
+- [JSON Web Tokens (JWT) vs Sessions](https://float-middle.com/json-web-tokens-jwt-vs-sessions/), [HackerNews thread](https://news.ycombinator.com/item?id=11929267)
 
 
-### Python
 
-See the reference API client:
 
-- [Documentation](http://python-shaarli-client.readthedocs.io/en/latest/) on ReadTheDocs
-- [python-shaarli-client](https://github.com/shaarli/python-shaarli-client) on Github