+- LogicMachine Forum (https://forum.logicmachine.net)
+-- Forum: LogicMachine eco-system (https://forum.logicmachine.net/forumdisplay.php?fid=1)
+--- Forum: Scripting (https://forum.logicmachine.net/forumdisplay.php?fid=8)
+--- Thread: Auth via URL for a custom app API (/showthread.php?tid=6448)
Auth via URL for a custom app API - Ceros2112 - 01.06.2026
Hello,
I'm building a custom app with a simple UI that stores some data in a database table but also needs to act as a server that passes those data in JSON format to other lm5s with a custom API request.
As the app is the endpoint of that http request, I need to authenticate my client to be able to access the app but I can't simply pass user:password in the url, right?
Is there a way to do it?
Thank you for your help
RE: Auth via URL for a custom app API - admin - 02.06.2026
Basic auth (user:password) can still be used. But the Authorization header must be sent explicitly without expecting a WWW-Authenticate header first.
RE: Auth via URL for a custom app API - Ceros2112 - 03.06.2026
Thank you but I tried (with a dedicated user, not admin) and it replied with:
- redirect to login when not using any auth (as expected)
- 400 bad request when using basic auth
- redirect to login when using basic auth but with wrong credentials
Request:
Quote:GET /apps/data/vacanze/api.lp HTTP/1.1
Host: 192.168.0.10
Authorization: Basic YXBpOlRlc3RfUGFzc3dvcmQx
User-Agent: curl/8.13.0
Accept: */*
Reply:
Quote:HTTP/1.1 400 Bad Request
Date: Wed, 03 Jun 2026 07:55:55 GMT
Content-Type: text/html
Content-Length: 122
Connection: close
X-Frame-Options: SAMEORIGIN
Cache-Control: no-store
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ws://192.168.0.10 wss://192.168.0.10; img-src * data:
Set-Cookie: x-login=1; Path=/; HttpOnly; SameSite=Strict
X-Content-Type-Options: nosniff
Permissions-Policy: autoplay=self,fullscreen=self
Referrer-Policy: same-origin
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
</body>
</html>
Reply with wrong credentials:
Quote:HTTP/1.1 302 Moved Temporarily
Date: Wed, 03 Jun 2026 07:57:19 GMT
Content-Type: text/html
Content-Length: 110
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Cache-Control: no-store
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ws://192.168.0.10 wss://192.168.0.10; img-src * data:
Set-Cookie: x-login=0; Path=/; HttpOnly; SameSite=Strict
Set-Cookie: x-session=; Path=/; HttpOnly; SameSite=Strict
Location: /login?err
X-Content-Type-Options: nosniff
Permissions-Policy: autoplay=self,fullscreen=self
Referrer-Policy: same-origin
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
</body>
</html>
RE: Auth via URL for a custom app API - admin - 03.06.2026
Add Origin header to your curl request:
Code:
-H "Origin: http://192.168.0.10"RE: Auth via URL for a custom app API - Ceros2112 - 03.06.2026
Thank you