API login by username and password

[alfa-alex]

The docs mention authentication by username and password but discourage its use because the username and the password are sent as a GET request.

However, following the approach the UI logs you in, it is possible to retrieve a token from a POST call:

curl -v -s -X POST \
    -H "Content-Type: application/json" \
    -d '{"application":"app-built-in","username":"admin","password":"123","autoSignin":true,"signinMethod":"Password","type":"login"}' \
    https://door.casdoor.com/api/login

This returns a set-cookie: casdoor_session_id=ea783f5...; Path=/; Expires=Fri, 26 Apr 2024 07:58:11 GMT; Max-Age=2592000; HttpOnly

1. Retrieving a token this way feels a bit hacky (as it is only returned in the set-cookie). Am I right to assume that this API is not guaranteed to be stable and thus should not be used from third-party applications?

2. The Use Case I have is a client application which should allow users to log in inside the application (i.e. not using a browser). The alternatives provided on the above page do not allow a login via username and password. Is this something casdoor does not want to support officially for some reason? Or am I missing something?

[hsluoyz]

@alfa-alex are you referring to: https://door.casdoor.com/records ? You can view that page because that's the demo site (which is public to everyone to demonstrate) and the admin password is provided. If it is for a self-deployed instance, you cannot access that without Casdoor global admin priviledge.

[alfa-alex]

I have no clue what that /records path is. I chose the demo URL because that's something everyone could easily reproduce, but I was equally able to make that call against the locally running all-in-one instance (using http://localhost:8000/api/login as the URL). And it was also possible for other valid username / password combinations, not only the default admin.

So my questions remain open. Most importantly: Is this a valid way to retrieve a token from a third-party application.

[hsluoyz]

@alfa-alex you can use OAuth 2.0 Client Credentials Grant: https://oauth.net/2/grant-types/client-credentials/

The Casdoor docs is: https://casdoor.org/docs/how-to-connect/oauth#client-credentials-grant

[alfa-alex]

Yes, I can do that, using a previously generated clientId and clientSecret. But this wouldn't allow logging in using the username and the password.

[hsluoyz]

Ignore the warning in: https://casdoor.org/docs/basic/public-api/#4-by-username-and-password if you insist in using password

[alfa-alex]

Okay, thank you!

I think the warning

The user credential will be exposed as GET parameters the in the request URL.

is very appropriate, so being able to use a POST request instead (like the one I posted above) would be preferable.

But from how I understood this discussion, you're not intending to support that officially.

[hsluoyz]

With HTTPS, is POST anything more secure than GET? I don't get it

And BTW, putting username and password into HTTP Basic Authentication header also works, if you thinks it's more secure

[alfa-alex]

Thank you so much!

(And yeah, I'd consider POST to be more secure than GET because URL parameters might be logged on the server side more easily / accidentally. It's basically cleartext from where the TLS offloading takes place.)