Is there any way of using the HTTP API without putting credentials (in plain text) in URL parameters? I'm a little baffled that this is even allowed. This is a security faux pas as literally anyone in between the request initiator and the PRTG endpoint will have the credentials.

I would expect to pass them in as part of the body or as part of the headers.

Is this possible?

Article Comments

Attention: This article is a record of a conversation with the Paessler support team. The information in this conversation is not updated to preserve the historical record. As a result, some of the information or recommendations in this conversation might be out of date.

Hello Justin,

Use parameter passhash instead of password in the API call. You can find the passhash in your user account's settings (Setup | Account Settings | My Account). It can only be used to run API calls, but not for logging in to PRTG's webinterface.

Kind regards,

Erhard


Jan, 2018 - Permalink

Hey Erhard,

This doesn't really solve the issue that Justin was flagging AFAICT. The point Justin was making is that the urls all contain the username and password for each request. URLs are useful debugging tools and often get logged, so having creds, even hashed creds that work for an extended duration, in the URL is not a common practice. Any use of the PRTG api requires end users to be meticulous about avoiding logging URLs.

Does that make sense?

Todd


Sep, 2021 - Permalink