Sythe API -- for third party apps/developers

To any developers,

We've put together an API which will let sythe.org users authenticate themselves in third party apps without entering their password.

The system works via tokens which are one use automatically generated passwords.

A user get a token from Quick Links like so:

Then the user copy pastes their token into the third party app which you (developer) have made. You then check that they are who they say they are with the script at http://www.sythe.org/checktoken.php?token=token_here

When a token is run with the script above it is 'used up'. These are one use passwords. The user can generate a new one by repeating steps above.

Output of the check token script is json, like so:

{"userid":"1","username":"Sythe","usergroupid":"6","joindate":"1114082940","posts":"3819","usertitle":"Director","icq":"","aim":"","yahoo":"","msn":"","skype":"","simple_username":"Sythe"}

Simple_username field is username with annoying characters stripped (for example if you want a simple version of their username for a chat name or something.) Other fields are self explanatory. Joindate is unixtimestamp, you can look up how to convert those.

We will be adding more info (such as donation amount/status) later.

Let me know what you think!

Cheers,
Richard

 

[Emperor Nero]

How long can you stay logged in on a single token? I generally 'stay logged in' from devices that I personally own and don't from school computers and such.

 

How long can you stay logged in on a single token? I generally stay logged in from devices that I personally own and don't from school computers and such.

The tokens are not for logging in to sythe.org.

 

[I_DONT_BOT]

I saw this yesterday and wondered what it was for. Is there any programs we can use them for at the moment?

 

[Add My Msn]

Edit: Because Syed is awesome, he explained it all to me.

 

[Grave]

I think you should create a page that we can embed with an iFrame, so the visitor to the third party site can view the token readily if they're logged in to Sythe.org

 

The only problem I currently have is the fact these tokens are onetime use only. I understand its purpose is to authenticate users, but I just feel that any third party app using them will end up requiring multiple usages throughout the day and getting the code/re-inserting it every time might cause to much hassle. Obviously if they were to last longer, then they could be saved/stored which would avoid the need to re-enter it every time you wanted to use the app.

Its easy enough for the app developer to remember who you are once you're authenticated. They just leave a cookie or file (depending on the type of app) and that's that.

If the tokens weren't one-use then it'd be a massive security flaw.

Lets say I write an IRC daemon where you can 'prove' you are X on sythe.org by submitting your token. If the token doesn't get used up, then I could record all the tokens the users submit, then go use them on other third party apps.

 

I think you should create a page that we can embed with an iFrame, so the visitor to the third party site can view the token readily if they're logged in to Sythe.org

This is a good idea. If you want to throw something suitable together I'll put it up. I assume you don't want it to look ugly since you'd be embedding it in your app.

 

[Grave]

This is a good idea. If you want to throw something suitable together I'll put it up. I assume you don't want it to look ugly since you'd be embedding it in your app.

http://sythe.us/authenticator.html

200 width, 125 height

(edit) If there are no security issues, why not just have a page that we can automatically grab the token from? That way people don't have to actually copy and paste the token, and developers can just grab it with PHP and automatically include it and plug it into the token check URL? I don't know if I'm missing something here, but I'm sure everyone would prefer that. Maybe a hybrid in between could work as well, where the user has to first accept for it to be automatically used.

 

http://sythe.us/authenticator.html

200 width, 125 height

Thanks

(edit) If there are no security issues, why not just have a page that we can automatically grab the token from? That way people don't have to actually copy and paste the token, and developers can just grab it with PHP and automatically include it and plug it into the token check URL? I don't know if I'm missing something here, but I'm sure everyone would prefer that. Maybe a hybrid in between could work as well, where the user has to first accept for it to be automatically used.

If you (developer) could grab a token for any user without that user's consent then it would defeat the purpose. The token is supposed to be a one use password that proves the user is who they say they are to a third party app.

And if you mean why not have the token jump from the iframe into the app by itself -- you can't. Violates XSS browser rules.

As to just having a button in an iframe that says "Authorize", that's oAuth type stuff. We might put that in later. Tokens are easier to implement for the moment for many apps.

For most apps you should only need the user to put in a token once (i.e. on signup) then keep your own records and user accounts.

 

[Clashfan]

Is this based on the token system you wrote for the official IRC a few years back? Thanks for putting this together.

 

Is this based on the token system you wrote for the official IRC a few years back? Thanks for putting this together.

No. Similar idea but different implementation.

 

Wouldn't the person have to accept the cookies in the first place, plus I personally wouldn't want to have a sythe member store a cookie which could end up tracking everything I go on.

Cookies do not work this way.

Also, I'm not 100% sure on this, surely both the cookies and files could end up being manipulated. So if I used the token on an app, then surely I could edit the cookie/file to match the information of someone else and then pretend to be them on the app. Obviously depending on how strict the cookies are in terms of using the IP of the person and so forth. So surely that could lead to problems in itself.

Almost every website on the internet uses cookies including this one (hence not having to login every 3 seconds). And they do ok.

Makes sense why it wouldn't be plausible. However this problem isn't fully solved with the onetime usage you have implemented as people with malicious intent still could make apps in which they request the tokens but don't actually use them and then use them elsewhere like you said. So if the person has the wrong motive then it isn't exactly going to stop them.

That is true. So some level of trust should exist between the user and app developer. Tokens expire automatically after 30 minutes.

 

Grave: http://sythe.org/gettoken.php

 

[Syed]

Good idea, but why is this in the suggestions forum? -.-

I was deciding on whether or not to add this to Phrashed's services as an anope module.

Something like /ns auth token and it would store a little line in their whois info.

Syed is [email protected] *
Syed is a Network Administrator
Syed is Ix Syed xI on Sythe.org

But I decided against it, mainly because of the amount of work for the payoff, but it's great knowing that if I ever do make anything similar, I could use this to authenticate Sythe users.

 

[I_DONT_BOT]

Seeing as trading isn't something that happens on IRC, I can't really see a use for it being coded in other than people chatting shit claiming to be members, but mods can run a quick I.P check to see if it is them tbh.

 

Here's an example for anyone nosy or curious:

http://servicepanelpro.com/panel/

Note: Your login attempts will fail since you don't have an account. But it illustrates the concept.

 

[Yenthe666]

Here's an example for anyone nosy or curious:

http://servicepanelpro.com/panel/

Note: Your login attempts will fail since you don't have an account. But it illustrates the concept.

^ I'm not sure if you will use this page for real purposes or not.
But you should make it so that a click on the textbox would copy the code automatically. (Like you would do a CTRL+C)
Thats easier for the user?

 

^ I'm not sure if you will use this page for real purposes or not.
But you should make it so that a click on the textbox would copy the code automatically. (Like you would do a CTRL+C)
Thats easier for the user?

That's actually more complicated than you would think because a lot of browser's handle the clipboard differently. I did already make it so when you click the token it highlights automatically...

 

[Noam]

That's actually more complicated than you would think because a lot of browser's handle the clipboard differently. I did already make it so when you click the token it highlights automatically...

You could do it with flash if I remember correctly
Either way most of them don't support clipboard commands through JS.