From 4e822244624cd8d4bc505f8b5acee9f0e16925db Mon Sep 17 00:00:00 2001 From: Xavier L'Hour Date: Fri, 18 Sep 2026 15:32:31 +0200 Subject: [PATCH 1/2] Bug 2073282 - Add deprecated api_key= query-parameter fallback to native Mojo REST auth --- Bugzilla/App/Plugin/Login.pm | 10 +++++++++- qa/t/rest_native_login.t | 7 +++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/Bugzilla/App/Plugin/Login.pm b/Bugzilla/App/Plugin/Login.pm index 55c845c507..2712565dad 100644 --- a/Bugzilla/App/Plugin/Login.pm +++ b/Bugzilla/App/Plugin/Login.pm @@ -107,7 +107,15 @@ sub register { # For api requests, we check for the api key in the header if ($usage_mode == USAGE_MODE_REST || $usage_mode == USAGE_MODE_MOJO_REST) { - if (my $api_key_text = $headers->header('x-bugzilla-api-key')) { + + # Deprecated fallback for the legacy ?api_key= query parameter, + # same as the legacy WebService dispatcher (see + # Bugzilla::WebService::Util::fix_credentials). This is a + # deprecation-pending stopgap, not a first-class supported method. + my $api_key_text + = $headers->header('x-bugzilla-api-key') || $c->param('api_key'); + + if ($api_key_text) { if (my $api_key = Bugzilla::User::APIKey->new({name => $api_key_text})) { my $remote_ip = $c->tx->remote_address; if ( diff --git a/qa/t/rest_native_login.t b/qa/t/rest_native_login.t index d798998654..6b23173a9c 100644 --- a/qa/t/rest_native_login.t +++ b/qa/t/rest_native_login.t @@ -49,6 +49,13 @@ $t->get_ok($url . $endpoint)->status_is(401); $t->get_ok($url . $endpoint => {'X-Bugzilla-API-Key' => $api_key}) ->status_is(200)->json_has('/result'); +# +# 2a. Deprecated fallback: an API key passed as the ?api_key= query parameter +# also works (bug 2073282), same as the legacy WebService dispatcher. +# +$t->get_ok($url . $endpoint . '&api_key=' . $api_key) + ->status_is(200)->json_has('/result'); + # # 3. Authentication via the login cookie + Bugzilla_api_token parameter works. # This is the mechanism the web UI (Bugzilla.API) uses, and is the path that From ba30b0ec7006077d8b8b7681244ea04187d52c71 Mon Sep 17 00:00:00 2001 From: Xavier L'Hour Date: Fri, 18 Sep 2026 15:54:11 +0200 Subject: [PATCH 2/2] Bug 2073282 - Note the deprecated api_key query-parameter fallback in REST auth docs --- docs/en/rst/api/core/v1/general.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/en/rst/api/core/v1/general.rst b/docs/en/rst/api/core/v1/general.rst index 252ae63735..903eddc652 100644 --- a/docs/en/rst/api/core/v1/general.rst +++ b/docs/en/rst/api/core/v1/general.rst @@ -114,8 +114,10 @@ Send only one authentication method with each request. BMO does not combine credentials or choose the strongest method when more than one is supplied. Most resources have been migrated off the legacy authentication path onto BMO's -native REST framework, which accepts only a cookie, an ``X-Bugzilla-API-Key`` -header, or an OAuth2 bearer token. Legacy ``Bugzilla_login`` and +native REST framework, which accepts a cookie, an ``X-Bugzilla-API-Key`` +header, or an OAuth2 bearer token (plus the deprecated ``api_key`` query +parameter described in the warning below, kept only as a stopgap for +undiscovered callers). Legacy ``Bugzilla_login`` and ``Bugzilla_password`` credentials are **not** accepted on these resources, even though the old WebService dispatcher underneath BMO still supports them for resources not yet migrated (currently ``Bug``, ``Group``, ``Product``, and