API not working from web ui

[FStefanni]

Hi,

I like to signal the following bug in the web ui for the rest api.
If I use it, I get this error:

{
  "code": 16,
  "message": "authorization metadata must in format 'Bearer <TOKEN>",
  "details": []
}

Which is due to the fact that the web api does not seems to send the correct request. In fact, the example curl is:

curl -X 'GET' \
  'https://lorawan.gizeroplatform.com/api/tenants?limit=100&offset=0' \
  -H 'accept: application/json' \
  -H 'Grpc-Metadata-Authorization: mysupertoken'

Whilst, as stated by the error, it should be:

curl -X 'GET' \
  'https://lorawan.gizeroplatform.com/api/tenants?limit=100&offset=0' \
  -H 'accept: application/json' \
  -H 'Grpc-Metadata-Authorization: Bearer mysupertoken'

Please note the added Bearer.
Of course, the fixed curl works fine.

Best regards.

[brocaar]

I believe if you paste in the authorization field Bearer <TOKEN> it should work fine?

[FStefanni]

Hi,

yes exactly. That's the bugs:

• wrong example of curl
• wrong execution by using the swagger ui

If I do the correct curl by command line, it works fine.

Regards.

[brocaar]

But isn't this expected? In Swagger you configure the Authorization header, not just the token. If in this textfield you enter Bearer <TOKEN> then the Swagger UI works fine + shows the correct curl commands.

I believe in your case you only entered <TOKEN> in the Authorization field which is causing this issue.

[FStefanni]

Ah, now I understand what you are meaning, and doing as you say works.
But this is not expected/clear from the webui.
In fact I put just the token into the form, not the Bearer <TOKEN>.
The form asks for the "api_key", and does not tell us to insert other stuff.
So this is misleading.

So I suggest to add the Bearer part automatically (maybe only if missing?).

Regards

[Z-J-X]

I tried to integrate into 'chirpstack v4', but I reported an error：
request

curl -X 'GET' \
  'http://10.32.233.182:8090/api/applications?limit=1' \
  -H 'accept: application/json' \
  -H 'Grpc-Metadata-Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJjaGlycHN0YWNrIiwiaXNzIjoiY2hpcnBzdGFjayIsInN1YiI6ImQyMDA4MjMyLTUwN2QtNDU2ZC1hNTNkLTEwZDYyNDllMDI5YiIsInR5cCI6ImtleSJ9.ltPtc_f_xjFKejqJMxkv0jlnb_bwWC1-Ih4toBVVcCs'

responce

  {
  "code": 3,
  "message": "invalid length: expected length 32 for simple format, found 0",
  "details": []
}

chirpstack log

2023-10-18T06:29:28.415935Z  INFO gRPC{uri=/api.ApplicationService/List}: chirpstack::api: Finished processing request status="200" latency=224.704µs

my docker-compose.yml

version: "3"

services:
  chirpstack:
    image: chirpstack/chirpstack:4
    command: -c /etc/chirpstack
    restart: unless-stopped
    volumes:
      - ./configuration/chirpstack:/etc/chirpstack
      - ./lorawan-devices:/opt/lorawan-devices
    depends_on:
      - postgres
      - mosquitto
      - redis
    ports:
      - 8083:8080

  chirpstack-gateway-bridge-eu868:
    image: chirpstack/chirpstack-gateway-bridge:4
    ports:
      - 1705:1700/udp
    volumes:
      - ./configuration/chirpstack-gateway-bridge:/etc/chirpstack-gateway-bridge
    depends_on:
      - mosquitto

  chirpstack-rest-api:
    image: chirpstack/chirpstack-rest-api:4
    command: --server chirpstack:8080 --bind 0.0.0.0:8090 --insecure --cors "*"
    ports:
      - 8090:8090
    depends_on:
      - chirpstack


  postgres:
    image: postgres:13.6
    volumes:
      - ./configuration/postgresql/initdb:/docker-entrypoint-initdb.d
      - postgresqldata:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=root

  redis:
    image: redis:5.0.14
    volumes:
      - redisdata:/data

  mosquitto:
    image: eclipse-mosquitto:2.0.14
    ports:
      - 1884:1883
    volumes:
      - ./configuration/eclipse-mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf

volumes:
  postgresqldata:
  redisdata:

[MightyPork]

@Z-J-X We hit the same bug.

Anything slightly wrong in the REST call gets you this message.

Here we discovered there is a mandatory GET parameter tenantId, if you add it, it starts working. The swagger does not say which fields are mandatory.

I believe tenant was called "organization" in v3.