Confirmed users
927
edits
Services/KeyExchange: Difference between revisions
→Server API
Tarek.ziade (talk | contribs) |
Tarek.ziade (talk | contribs) |
||
| Line 83: | Line 83: | ||
== Server API == | == Server API == | ||
The only valid HTTP response codes are 200 and 304 since those are part of the protocol and expected to happen. Anything else, like 400, 404 or 503 must result in a complete termination of the password exchange. The client can retry the exchange then at a later time, starting all over with clean state. | The only valid HTTP response codes are 200 and 304 since those are part of the protocol and expected to happen. Anything else, like 400, 403, 404 or 503 must result in a complete termination of the password exchange. The client can retry the exchange then at a later time, starting all over with clean state. | ||
Every call must be done with a ''X-Weave-ClientID'' header, containing an identifier for the client. This id must be a string of at least 32 chars and at most 256 chars. It can be created with a md5 or sha hash of a random number for instance. The server will keep track of the two first ids used for a given channel, from its creation to its deletion and will close the channel and issue a 400 if any request is made with an unkown id or with no id at all. | Every call must be done with a ''X-Weave-ClientID'' header, containing an identifier for the client. This id must be a string of at least 32 chars and at most 256 chars. It can be created with a md5 or sha hash of a random number for instance. The server will keep track of the two first ids used for a given channel, from its creation to its deletion and will close the channel and issue a 400 if any request is made with an unkown id or with no id at all. | ||
Last, if a given IP attempts to do more than 100 requests in less than 5 minutes, the server will blacklist the IP for 10 minutes and return a 403 in the interim. When receiving this error code, legitimate clients can fall back to a manual transaction. | |||
The server API knows four calls: | The server API knows four calls: | ||
| Line 102: | Line 104: | ||
- 503: the server was unable to create a new channel. | - 503: the server was unable to create a new channel. | ||
- 400: Bad or no ClientId. The channel is deleted. | - 400: Bad or no ClientId. The channel is deleted. | ||
- 403: the IP is blacklisted. | |||
| Line 119: | Line 122: | ||
- 304: the data was not changed. | - 304: the data was not changed. | ||
- 400: Bad or no ClientId. The channel is deleted. | - 400: Bad or no ClientId. The channel is deleted. | ||
- 403: the IP is blacklisted. | |||
| Line 131: | Line 135: | ||
to ''new_channel'' or timed out. | to ''new_channel'' or timed out. | ||
- 400: Bad or no ClientId. The channel is deleted. | - 400: Bad or no ClientId. The channel is deleted. | ||
- 403: the IP is blacklisted. | |||
| Line 143: | Line 148: | ||
to ''new_channel'' or timed out or already deleted. | to ''new_channel'' or timed out or already deleted. | ||
- 400: Bad or no ClientId. The channel is deleted. | - 400: Bad or no ClientId. The channel is deleted. | ||
- 403: the IP is blacklisted. | |||
== Detailed Flow == | == Detailed Flow == | ||