Login via REST API

[JGeek00]

Login via REST API

[crkos]

It is possible, This is basically what i had to do to make it work with Extension, You can take a look at my implementation in the extension in the actions and what calls that, or if you want to go and read the documentation of next-auth (or see what is called when you log in into Linkwarden) https://next-auth.js.org/getting-started/rest-api

https://github.com/linkwarden/browser-extension/blob/main/src/%40/lib/auth/auth.ts

[habibur4340]

For logging into your self-hosted Bitwarden through the REST API, if the documentation lacks specific details on authentication for existing users, consider looking into generic authentication endpoints often provided for session creation or token generation. Typically, APIs offer endpoints for "login" or "authenticate" actions, requiring credentials in the request body.

If further clarification or testing is needed, Apidog could be a valuable tool. It allows you to explore and test API endpoints interactively, helping you to understand the authentication flow, even when documentation is incomplete or unclear. Utilizing Apidog can assist in determining the correct approach for logging in via the API.

[JGeek00]

@crkos i have checked your implementation and I have done the same:

1. Get the csrf token with the /auth/csrf endpoint
2. Call to /auth/callback/credentials with the following form data, being callbackUrl "$baseUrl/login":

{
        "username": Uri.encodeFull(username),
        "password": Uri.encodeFull(password),
        "redirect": false,
        "csrfToken": Uri.encodeFull(csrfToken),
        "callbackUrl": Uri.encodeFull(callbackUrl),
        "json": true,
      }

But I receive a 302 from the second endpoint. Do you know why this can happen?

[crkos]

Mmm not really, did you send it as 'Content-Type': 'application/x-www-form-urlencoded'?, I think this is the only way to make it work, other thing is that you may already have a cookie set

[JGeek00]

Yes, I am adding the content type. I'm working on a Flutter mobile application but I cannot make to work the follow redirect after the response of that second endpoint. It appears that flutter's http package doesn't support follow redirect for post requests, so I'm getting a 302.