[Web API] Retrieve licenses in bulk

Web API
#1

I would like to retrieve license details in bulk using their keys.

As far as I can tell, we have:

  • GET /v3/licenses : we can filter the list based on a license key using the key parameter, but my understanding is that we can only provide a single key. Is that right?

  • GET /v3/licenses/{id} : this can only be used to get a single license at a time.

I would like to avoid sending many requests, is there a way to do this in bulk?

#2

Hi Lindale,

As of now, we do not support retrieving license details in bulk, But we are planning to do so by adding support for various operators in query parameters in a month or so.

#3

This is great news! I’m looking forward to it

#4

Hi,

We have added support for query operators, you can now do the following:

GET /v3/licenses?key[in]=key1,key2,key3

#5

That’s perfect, thanks a lot!

Is there a limit on the length of the query parameters?

#6

As such there is no limit. You can pass any number of license keys.

1 Like
#7

I noticed that when calling GET /v3/licenses?key[in]= (empty key[in] param), all licenses are returned.

I wasn’t expected this, and noticed it by chance. I believe this could cause security issues, and I think it should return an empty array.

#8

We ignore all the query params which are empty, hence [in] is ignored if you don’t pass any value. We can’t change this as this has been the default behaviour for all the query params even before we introduced query operators.

I guess it is not a security issue because anyone having access to the access token can anyways read all the licenses.

#9

Indeed it’s not a direct security issue. But it’s easy to do something like that:

const licenses = await getRepository(License).find({
  where: { user: user }]
});

const licenseKeys = licenses.map(license => license.key);

const cryptlexLicenses = await httpClient.get(
  `https://api.cryptlex.com/v3/licenses?key[in]=${licenseKeys.join(',')}`
);

const formattedLicenses = cryptlexLicenses.map(license => formatLicense(license));

return res.json(formattedLicenses);

This would return all licenses if the user doesn’t have any.

You should at least explain this behavior in the docs. I think many people do not expect this.

#10

Yes, it will cause the issue in your case. I guess you need to add a check if licenseKeys array is empty.

We will see how we can update our API docs to convey this behaviour.

#11

Yes this is what we already do, the above is just an exemple. But we first implemented the check to avoid unnecessary requests. It’s just because I noticed the behavior by chance that I realised how important the check is, security-wise.