3. Auth Tokens

Auth Tokens

  • Dev Team

    @tedivm You can open the URL directly instead of embedding it in an iframe or a web view, that's the decision of the client developer and has nothing to do with how the server works.

    1 Reply
  • Culture

    @artch said in Auth Tokens:

    @tedivm You can open the URL directly instead of embedding it in an iframe or a web view, that's the decision of the client developer and has nothing to do with how the server works.

    Then I'm not sure I understand how that would work. Where does the URL for the iframe come from and how does it lock itself in to a specific token?

    1 Reply
  • Dev Team

    @tedivm The URL is always the same. It's in the account settings, but we can make its variant without UI with a special flag like https://screeps.com/a/#!/account/auth-tokens/reset?noui=1. It doesn't lock a specific token, since rate limiting is user-based, not token-based, so it simply resets the user counter (both for persistent auth tokens and for regular one-time tokens). A third-party client might use any token mechanism, and give this URL to the user every time the servers responds that it's required to proceed.

  • Overlords

    I've had a confusing discussion on Slack around the rate limit on POST /api/user/code.

    I updated rollup-plugin-screeps to require a token when pushing to screeps.com which causes its deploys to be rate-limited to 10 per hour.

    I've been told that grunt-screeps doesn't get rate limited, but when looking at the code I thought it was because it is still using username/password authentication (https://github.com/screeps/grunt-screeps/blob/master/tasks/screeps.js#L61). Is it not going to need updating?

    Unlike node-screeps-api which uses /api/auth/signin to get a token and then uses that token to push code it appears that grunt-screeps uses an auth header to send email:password. Is the header going to stay and not be rate limited?

    2 Replies
  • Culture

    @arcath node-screeps-api also optionally uses a token directly skipping the /api/auth/signin step. gulp-screeps has already been updated to use a token if supplied.

  • Culture

    Can you raise the ratelimit on GET /api/user/memory? Right now it is set at 60 per hour (once per minute). If possible (and I understand if this isn't) could that be made a "per shard" thing? If not can it be raised slightly- say 120 per hour?

  • Overlords

    @ags131 said in Auth Tokens:

    @arcath node-screeps-api also optionally uses a token directly skipping the /api/auth/signin step. gulp-screeps has already been updated to use a token if supplied.

    I'm using tokens if one is supplied and it requires you use a token for screeps.com

    It was mentioned by @dissi-mark on slack that grunt-screeps didn't have a rate limit. From looking at grunt-screeps source it appears that POST /api/user/code takes an auth header that isn't rate limited? I'd like to know if this is the case so I can change rollup-plugin-screeps back to requiring a username/password to use that header.

  • Dev Team

    Update

    • There is now a way to turn off rate limiting for a specific token for 2 hours, see documentation.

    • Limit values are updated. Some limits are per-day now.

    • Two new endpoints added to token access scope:

      • GET /api/user/money-history
      • GET /api/market/my-orders

    • Added an option to add description to a token.

    • New endpoint /api/auth/query-token?token=XXX which shows the access scope and unlimited period timer for a token.

    • Endpoint /api/user/memory-segment now accepts segment query param as a list separated by a comma.

    👍
    1 Reply
  • Dev Team

    @arcath Basic auth will become rate limited using the same limits soon. You are better off using tokens, since you can now turn off rate limiting for tokens, unlike basic auth which is always limited.

    👍
  • Culture

    These updates are fantastic, thank you!

    I have one more idea, although it's just a convenience factor and is definitely not required. From a usability perspective it's easier for people to remember a username/password than it is to remember a token. It would be nice if third party tools could directly request a token from an endpoint that took the username and password.

    POST /api/auth/gettoken - takes username and password, returns token.

    The token would still be rate limited, and no other endpoints besides this one would work with the username/password combination without recaptcha.

    Two scenarios I see for this-

    1. People who use the third party client, such as @bonzaiferroni's 3d one, can simply type in their username/password like they already do. This way the client doesn't have to persist tokens for each user and server combination. This makes it easier on players who use multiple servers- or players who share a computer.

    2. For tools like the standalone console, the autospawner, or the backup tool they can create the token directly from the tool itself, and then those tools can persist the token.

    None of this is required by any means, but it would make it really convenient for people to install their new tools.

  • YP

    3rd party tools should never ask for the username/password. That was the reason why we asked for tokens in the first place.

    👍
    1 Reply
  • Culture

    @w4rl0ck I disagree. There is essentially no difference from a "full access token" and supplying credentials, and for applications that are open source and self hosted it shouldn't make much of a difference. The reason a lot of the third party tool developers wanted tokens was for the things that weren't self hosted- for example, if @ags131 wants to create a central service where people can put a token in and get stats dumped into their screepsplus account.

    1 Reply

  • @tedivm There is one problem with username/password login, even for open source and self-hosted software. Most of the time, no one goes through the effort of reviewing the code. Then you have to make sure the binary you download actually matches the code you reviewed - there's no guarantee that they match, and this step is even less common.

    1 Reply
  • Culture

    @jbyoshi most (not all, but most) of the third party tools aren't compiled so you don't have to worry about binary matching. This same problem exists for a variety of tools- mail clients being a popular one- and with the "full access" token granting "full access" there isn't much difference between a token and a set of credentials when it comes to access.

  • Dev Team

    The difference is that a token can be revoked at any moment.

    1 Reply
  • Culture

    @artch a password can also be changed at any moment, and since the method I proposed still relies on a token for all major operations those tokens can also be revoked right after the password is.

    I don't mean to get into an argument, and if this idea isn't a priority then that doesn't bother me all that much. From a security standpoint though this isn't as big of a deal as people are making it out to be.

    1 Reply
  • YP

    Well I did not try but I think full access tokens should not let you change your email, password, cancel the account or link it to a steam account, open support tickets and other account stuff like that.

    Also I think it's important to teach people to not enter credentials of whatever account to 3rd party sites.

    1 Reply
  • Culture

    @w4rl0ck for the record, Github themselves use the exact method I'm proposing for their API. Here's the relevant code on Gitconsensus. As much as I love Screeps I tend to consider Github to have much higher security requirements and they have no problem with this method.

    Encouraging people not to enter their credentials into third party sites is super important, which is why I included it in the third party tools page right at the top. Another thing we should do is encourage them not to use the same password in multiple places, as that can result in it getting out and causing more issues. I totally agree with this.

    However, if we're already encouraging people to open up a webview in their application for authentication (something that has come up in this thread repeatedly, and which would easily allow someone to screenshot or keylog credentials) there isn't much of a difference between that and an official way to get a token. This just adds a layer of convenience, especially for people who want to put one of these tokens on a mobile client.

    2 Replies
  • Dev Team

    @tedivm said in Auth Tokens:

    However, if we're already encouraging people to open up a webview in their application for authentication (something that has come up in this thread repeatedly, and which would easily allow someone to screenshot or keylog credentials) there isn't much of a difference between that and an official way to get a token.

    Just for the record - the https://screeps.com/a/#!/account/auth-tokens/noratelimit?token=XXX embeddable UI doesn't require authentication, it can be used by an anonymous visitor, there is no login popup. Its purpose is to solve CAPTCHA rather than to authenticate the user.

    ❤
  • YP

    @tedivm for the record, I would never courage someone to enter his github credentials at any other site, nor do I think github states anywhere that you should do so. If I would enter my github credentials at other sites I would have serious problems at work.

    They might have the api for personal tools, but for sure not to enter credentials at different sites. They have a page where they tell their user to never share their passwords with anyone: https://help.github.com/articles/creating-a-strong-password/

    @artch : I see a possible problem with the turning off rate limiting for 2 hours for specific tokens. Maybe those tokens should be changed that they can only used when enabled with the link.

    The problem I see is that a 3rd party client could use up all daily usages of a endpoint, for example the memory access, while the limits are not disabled, so other scripts would no longer work at all for the day. Or does pressing the button also resets the api limits?

    1 Reply