Login subsystem#
Login#
To login, POST JSON to /api/login
with the following structure:
{
"User": "username",
"Pass": "password"
}
and the server will respond with the following to indicate whether login was successful:
{
"LoginStatus":true,
"JWT":"reallylongjsonwebtokenstringishere"
}
If the login failed, the server will return a structure with a “reason” property:
{
"LoginStatus":false,
"Reason":"Invalid username or password"
}
Instead of sending JSON, you may also set form fields “User” and “Pass” in the login POST request.
Logout#
PUT /api/logout - logs your current instance out
DELETE /api/logout - logs out ALL your user’s instances
JWT protections are enforced on all requests that are not used for file download operations.#
The JWT received from the login API must be included as an Authorization Bearer header on all other API requests.
Authorization: Bearer reallylongjsonwebtokenstringishere
Websocket Authentication#
As a convenience, the websocket API endpoints will also look for the JWT token in the Sec-Websocket-Protocol
header value. Many websocket implementations do not properly support passing header values, so we overload the websocket subprotocol negotiation header. The API endpoints will still look for the standard Authentication
header values as well.
View active sessions#
Send a GET to /api/users/{id}/sessions
and it will return a chunk of JSON. Admins can request any users sessions, users can ONLY request their own sessions.
{
"Sessions": [
{
"LastHit": "2020-08-04T15:28:12.601899275-06:00",
"Origin": "127.0.0.1",
"Synced": false,
"TempSession": false
},
{
"LastHit": "2020-08-03T23:59:53.807610997-06:00",
"Origin": "127.0.0.1",
"Synced": false,
"TempSession": false
},
{
"LastHit": "2020-08-04T09:45:48.291770859-06:00",
"Origin": "127.0.0.1",
"Synced": false,
"TempSession": false
}
],
"UID": 1,
"User": "admin"
}