{"action":"created","issue":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/976","labels_url":"https://api.github.com/repos/IQSS/dataverse/issues/976/labels{/name}","comments_url":"https://api.github.com/repos/IQSS/dataverse/issues/976/comments","events_url":"https://api.github.com/repos/IQSS/dataverse/issues/976/events","html_url":"https://github.com/IQSS/dataverse/issues/976","id":46199190,"number":976,"title":"Block /api/s/ after installation","user":{"login":"michbarsinai","id":1938468,"avatar_url":"https://avatars.githubusercontent.com/u/1938468?v=3","gravatar_id":"","url":"https://api.github.com/users/michbarsinai","html_url":"https://github.com/michbarsinai","followers_url":"https://api.github.com/users/michbarsinai/followers","following_url":"https://api.github.com/users/michbarsinai/following{/other_user}","gists_url":"https://api.github.com/users/michbarsinai/gists{/gist_id}","starred_url":"https://api.github.com/users/michbarsinai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michbarsinai/subscriptions","organizations_url":"https://api.github.com/users/michbarsinai/orgs","repos_url":"https://api.github.com/users/michbarsinai/repos","events_url":"https://api.github.com/users/michbarsinai/events{/privacy}","received_events_url":"https://api.github.com/users/michbarsinai/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Component:%20API","name":"Component: API","color":"c7def8"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Priority:%20Critical","name":"Priority: Critical","color":"ff9900"},{"url":"https://api.github.com/repos/IQSS/dataverse/labels/Type:%20Feature","name":"Type: Feature","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/IQSS/dataverse/milestones/11","html_url":"https://github.com/IQSS/dataverse/milestones/Dataverse%204.0:%20Final","labels_url":"https://api.github.com/repos/IQSS/dataverse/milestones/11/labels","id":720835,"number":11,"title":"Dataverse 4.0: Final","description":"- Complete data and account migration\r\n- Final integration with TwoRavens and Zelig 5\r\n- Read only mode\r\n- Documentation\r\n- UI clean up\r\n- APIs finished\r\n- Code and testing completed","creator":{"login":"scolapasta","id":4268292,"avatar_url":"https://avatars.githubusercontent.com/u/4268292?v=3","gravatar_id":"","url":"https://api.github.com/users/scolapasta","html_url":"https://github.com/scolapasta","followers_url":"https://api.github.com/users/scolapasta/followers","following_url":"https://api.github.com/users/scolapasta/following{/other_user}","gists_url":"https://api.github.com/users/scolapasta/gists{/gist_id}","starred_url":"https://api.github.com/users/scolapasta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scolapasta/subscriptions","organizations_url":"https://api.github.com/users/scolapasta/orgs","repos_url":"https://api.github.com/users/scolapasta/repos","events_url":"https://api.github.com/users/scolapasta/events{/privacy}","received_events_url":"https://api.github.com/users/scolapasta/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":4,"state":"open","created_at":"2014-07-14T20:18:22Z","updated_at":"2015-02-25T19:17:39Z","due_on":"2015-03-26T04:00:00Z","closed_at":null},"comments":2,"created_at":"2014-10-19T07:38:06Z","updated_at":"2015-02-26T17:06:48Z","closed_at":null,"body":"This is the api point where all the \"admin\" stuff goes. Currently no blocking is done there.\r\nOptions:\r\n1. Allow from localhost only\r\n2. add a \"block\" call, that once called blocks that api endpoint. Unblocking done by altering a record in the database (possibly using the settings table).\r\n3. Others?"},"comment":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/comments/76219163","html_url":"https://github.com/IQSS/dataverse/issues/976#issuecomment-76219163","issue_url":"https://api.github.com/repos/IQSS/dataverse/issues/976","id":76219163,"user":{"login":"bencomp","id":1303898,"avatar_url":"https://avatars.githubusercontent.com/u/1303898?v=3","gravatar_id":"","url":"https://api.github.com/users/bencomp","html_url":"https://github.com/bencomp","followers_url":"https://api.github.com/users/bencomp/followers","following_url":"https://api.github.com/users/bencomp/following{/other_user}","gists_url":"https://api.github.com/users/bencomp/gists{/gist_id}","starred_url":"https://api.github.com/users/bencomp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bencomp/subscriptions","organizations_url":"https://api.github.com/users/bencomp/orgs","repos_url":"https://api.github.com/users/bencomp/repos","events_url":"https://api.github.com/users/bencomp/events{/privacy}","received_events_url":"https://api.github.com/users/bencomp/received_events","type":"User","site_admin":false},"created_at":"2015-02-26T17:06:48Z","updated_at":"2015-02-26T17:06:48Z","body":"I'm a bit surprised that even for some API `GET` calls you need an API key, but for serious admin stuff there is nothing (except for a \"future IP whitelist\"). How about a super super secret key and only access via HTTPS and only from localhost?\r\n\r\nWith Apache as a (reverse) proxy in front of Glassfish, you could filter requests to this path, but it sounds like a job for the firewall. (I haven't fully thought this one through, but you want a balance between security and managability, i.e. making it secure in one place, but truly secure. In other words, the mechanism to make it secure must be transparent, but the key must be unbreakable.)"}}