Password Limitations?

Hi Paul,

This issue has been brought up previously, though it is not really a bug, it's an inherent issue of using a URL string to pass the username and password. While cAPI does provide that capability, it is limited by the fact that URLs will break at certain special characters.

What you want to do is use the BASIC_AUTH capabilities or token based authentication. With BASIC_AUTH, credentials are guaranteed to be pass through the API server correctly.

learn.getcapi.org/intermediate/basic-authentication

After some consideration, the following API method should probably be deprecated:

learn.getcapi.org/api-methods/joomla-api-routes/user/get-user-login-username-password

yourdomain.com/api/v1/login/:username/:password

That's because the moment you include a special character in your password, the URL request will break at that character. A long term solution would be tor require that the password be BASE64 encoded prior to passing it into the URL request.

Note: This is not "security" as BASE64 is not encryption, but rather reversible encoding. It's main purpose in this case would be to allow passwords strings to be passed through via a URL request in such a way that the can be decoded on the receiving end without being adulterated.

Although this is the community support forum, I felt it important to respond to this question because I am sure others have experience this issue as well. My recommendation, to avoid issues with special characters, is to use the BASIC_AUTH method or token authentication (or require your users to create passwords with no spaces, no special characters... not ideal).