Using The Api Securely

[gutterboy]

Hello,

 

Just noticed this note in the docs:

 

"Because each request contains your API key, and may contain additional sensitive information, you should only process requests remotely over a secure connection (i.e. only use HTTPS)"

 

So what is the best method to make use of the API in your scripts if you don't have a SSL cert?

[Michael]

you don't need a SSL for most scripts like cPanel.

[gutterboy]

you don't need a SSL for most scripts like cPanel.

 

Not sure what you mean?

[Ken]

Hello,

 

Just noticed this note in the docs:

 

"Because each request contains your API key, and may contain additional sensitive information, you should only process requests remotely over a secure connection (i.e. only use HTTPS)"

 

So what is the best method to make use of the API in your scripts if you don't have a SSL cert?

Why are you unable to use SSL?

[gutterboy]

Why are you unable to use SSL?

 

I didn't say I was unable, I said we don't have a SSL cert.

[Michael]

Not sure what you mean?

 

on the cpanel module you use "use SSL" and go to https://cpaneldomain.com:2087 on Interworx https://licensecart.com:2334 no SSL for them scripts. But I can still use the SSL Function on the modules for security.

[gutterboy]

on the cpanel module you use "use SSL" and go to https://cpaneldomain.com:2087 on Interworx https://licensecart.com:2334 no SSL for them scripts. But I can still use the SSL Function on the modules for security.

 

Thanks for the response, but I'm still unsure what you're talking about. Just not sure how this refers to using the API?

 

http://docs.blesta.com/display/dev/API

[Michael]

Thanks for the response, but I'm still unsure what you're talking about. Just not sure how this refers to using the API?

 

http://docs.blesta.com/display/dev/API

 

Ok you're talking about the API, you don't need to use HTTPS:// on your own installation's API.

 

 

However in the picture you can use that button for security and it doesn't need to have a SSL on your domain to connect to it.

[gutterboy]

Oh ok gotcha!

[Cody]

I didn't say I was unable, I said we don't have a SSL cert.

 

Use a self-signed cert if you don't want to purchase one. If you're not connecting to the API over a trusted local area network (i.e. http://localhost/api/) then you should absolutely use https. Self-signed certs should be no problem to create and use.

[gutterboy]

Ok thanks for the tip!

[Mickey]

You could also get a free certificate from somewhere like https://www.startssl.com/