How is the new API system working?

[dhmello]

How is the new API system working? I can connect to my API using Postman, but when using an internal site to access the API, I get a connection error, it cannot find it

I followed all the API docs and references. I can connect, get the key, check online players, give items, etc., using Postman.

However, when trying to use a CMS or any method using CURL, it doesn't work.

Is there something missing that I need to configure? I already set up reverse proxy and, as I said, it works normally through Postman.

{
  "Api": {
    "Enabled": true,
    "Cors": { },
    "AllowedNetworkTypes": 1,
    "RequestLogLevel": "Trace",
    "TokenGenerationOptions": {
      "AccessTokenLifetime": 5,
      "Audience": "https://localhost/api",
      "Issuer": "https://localhost",
      "RefreshTokenLifetime": 10080,
      "Secret": "EE5C099F65848AC58AFF941CCA98C866EEEF515BF1211EAB1DD443A0CDDD1FDF"
    },
    "KnownProxies": [],
    "StaticFilePaths": [
      {
        "SourcePath": "wwwroot"
      }
    ],
    "JwtBearerOptions": {
      "TokenValidationParameters": {
        "ValidAudience": "https://localhost/api",
        "ValidIssuer": "https://localhost"
      }
    }
  },
  "DetailedErrors": false,
  "Kestrel": {
    "AddServerHeader": false,
    "AllowResponseHeaderCompression": true,
    "DisableStringReuse": false,
    "Endpoints": {
      "Https": {
        "Certificate": {
          "Path": "rebornia.crt",
          "KeyPath": "rebornia.key"
        },
        "Url": "https://*:5443"
      }
    },
    "Limits": {
      "MaxConcurrentConnections": 100,
      "MaxConcurrentUpgradedConnections": 100
    }
  },
  "Logging": {
    "Common": {
      "MinimumLevel": {
        "Default": "Error",
        "Override": {
          "Intersect": "Warning",
          "Microsoft": "Warning",
          "System"
```: "Warning"
        }
      }
    }
  }
}

[WeylonSantana]

When accessing the api externally there must be a whole configuration to have https running normally as this is the only way to allow access to the api, that being said I know that the AllowedNetworkType should be 4, and perhaps some other extra configuration

as a reference I follow this
https://hosting.freemmorpgmaker.com/index.php?rp=/knowledgebase/17/Setup-API-Access-Intersect-Beta-8-and-After.html

it works well to connect to the intersect hosting, so it should work for you if you really have everything configured correctly (especially the reverse proxy part)

[dhmello]

So my friend, I realized that this might have been a brief tutorial on how to make it work on JC's hosting... I've been talking with Google and ChatGPT, and both told me that when the server is accessible through Postman but not through any internal/external site, it might have something to do with CORS. However, I don't know what example I could follow to make this work.

[dhmello]

i am accessing it via the link: https://api.rebornia.com.br/

Using the JSON correctly,

POST Method,

json

{
    "grant_type": "password",
    "username": "MY ACC WITH API ROLES",
    "password": "MY PASS SHA256 ENCRYPTED"
}

[WeylonSantana]

i am accessing it via the link: https://api.rebornia.com.br/

Using the JSON correctly,

POST Method,

json

{
    "grant_type": "password",
    "username": "MY ACC WITH API ROLES",
    "password": "MY PASS SHA256 ENCRYPTED"
}

If I had to access your api link in the "/api/oauth/token" route, how would I do it in Chrome, to get the 405 (Not Allowed) response, what would be the link with your api? If I put the link in the browser and nginx returns 502 then I will always be led to believe that it is some wrong configuration in the reverse proxy

regardless of the configuration being on jc hosting, look, he has all the correct configuration so that it is accessible externally even through the browser

[dhmello]

i got error 405

[WeylonSantana]

I tested here and received error 426 (https required) and not 405, so some change has already happened

[dhmello]

oh yes, i doing some tests...

[dhmello]

you can try again

[WeylonSantana]

okay, now i get the 405, so now it should probably be ok for the api to work, try to get your api token with api username and password and everything should be ok

[dhmello]

Yes, with POSTMAN, this is possible, but intersect CMS or other website projetct or script or, CURL acess it doesnt.. :(

[jcsnider]

The 'AllowedNetworkTypes' field controls which ip address ranges are even allowed to connect if I recall correctly.

1 means that only localhost can communicate.
4 means any local area network ip address.

2/3 are something in the middle. Unless you use a reverse proxy I do not think that you will be able to get remote api access working over the internet without code changes.

Furthermore I have never seen the certificate fields actually used and working with the kestrel properties. Not sure if it works or not.

My recommendation:

• Set up an Nginx Reverse Proxy which can accept the HTTPS connection and proxy it to your api over HTTP (notice that this is NOT HTTPS). This is how my hosted servers work.
• In your Nginx site config make sure to include these properties:

proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

There is a really nice docker called NginxProxyManager which I use and personally like which can make this even easier.

Keep in mind that Nginx has a site setup with https and a certificate. The game server has mostly default settings. Make these changes but for KnownProxies use the IP address where your reverse proxy connects from (ie 127.0.0.1 or 192.X.X.X)

[adiif1]

@jcsnider but look why i try acces to api with api.domain.com:5443 have always ERR_SSL_VERSION_OR_CIPHER_MISMATCH?
if add reverse proxy as only / at all its work good but with :5443 or /5443 have above error?

api.domain.com/api/oauth/token
above work perfect without anyone issue

i need change localhost to my api.domain in this place?

        "Audience": "https://localhost/api",
      "Issuer": "https://localhost",
        "ValidAudience": "https://localhost/api",
        "ValidIssuer": "https://localhost"

AllowedNetworkTypes and KnownProxies Deleting and typing in complete nonsense, it still works. Are you sure it is even being used at all?

The best connection time between the API and the server, removing proxy_set_header Host $host; adds a few milliseconds to the connection and response time.

location / {
        proxy_pass https://localhost:5443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto  $scheme;
        proxy_set_header X-Forwarded-For    $remote_addr;
        proxy_set_header X-Real-IP          $remote_addr;
    }

my api config ( No matter if I set AllowedNetworkTypes to 1 or 4, I can connect from outside localhost in both cases. :))

{
  "Api": {
    "Enabled": true,
    "Cors": {},
    "AllowedNetworkTypes": 1,
    "RequestLogLevel": "Trace",
    "TokenGenerationOptions": {
      "AccessTokenLifetime": 5,
      "Audience": "https://localhost/api",
      "Issuer": "https://localhost",
      "RefreshTokenLifetime": 10080,
      "Secret": "EBE36DDD116CA1B2388601ACC04F971953C59184ED56A323EB5EFEC11B9C4C5D"
    },
    "KnownProxies": ["127.0.0.1"],
    "StaticFilePaths": [
      {
        "SourcePath": "wwwroot"
      }
    ],
    "JwtBearerOptions": {
      "TokenValidationParameters": {
        "ValidAudience": "https://localhost/api",
        "ValidIssuer": "https://localhost"
      }
    }
  },
  "DetailedErrors": false,
  "Kestrel": {
    "AddServerHeader": false,
    "AllowResponseHeaderCompression": true,
    "DisableStringReuse": false,
    "Endpoints": {
      "Https": {
        "Certificate": {
          "Path": "self-signed.crt",
          "KeyPath": "self-signed.key"
        },
        "Url": "https://*:5443"
      }
    },
    "Limits": {
      "MaxConcurrentConnections": 100,
      "MaxConcurrentUpgradedConnections": 100
    }
  },
  "Logging": {
    "Common": {
      "MinimumLevel": {
        "Default": "Error",
        "Override": {
          "Intersect": "Warning",
          "Microsoft": "Warning",
          "System": "Warning"
        }
      }
    }
  }
}

[dhmello]

@jcsnider , is there something that needs to be configured on Ubuntu to make it accessible itself? For example, we are trying to access the rebornia.com.br website on the browser of the OS that is hosting the site, and it can't find it.

Do you know what could fix this?

[jcsnider]

@adiif1 are you using my hosting?

As long as the reverse proxy is running on your local machine then known proxies/allowed network types should not matter.

The whole point of the reverse proxy is to allow external networks to access the api through that proxy.

To that end, only the reverse proxy on a local network should be able to talk to the server through :5443

Everyone else will need to talk to the server using your domain which routes through the proxy.

[adiif1]

No at the moment i tested all into my server
if the server and web server are on one server, what IP should I communicate with localhost / 127.0.0.1?
if so, there is an error ERR_SSL_VERSION_OR_CIPHER_MISMATCH every time or copletly no connect, which is very incomprehensible.

I would like it to be only local and not go out to the world, but for example the nginx service would have access to it
@jcsnider

[dhmello]

Thank you all very much for the attention on this topic, but I managed to solve the problem, and I am posting here how I made it work, in case it is useful for someone.

Special thanks to @adiif1 @XFallSeane for discord support

I defined my Ubuntu iptables as follows:

127.0.0.1 api.rebornia.com.br
127.0.0.1 rebornia.com.br

"KnownProxies": ["127.0.0.1","MY EXTERNAL IP"],

In Nginx

proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

And with that, everything works now.

[jcsnider]

Glad you got this working.