The so called "Bug" is the lack of documentation. But the function you are describing is how securing a API request works.
A good start would be Http RESTful API - GL.iNet IoT Docs
- Use your credentials to gather a token.
- Use the token within a timeframe to gather your information or place your settings
- If the token is too old, get a new one, start from 1.
Of course you could send your credentials with every request ... But how would this be secure?
I don't know if we talk about bash (.sh) or python (.py) ... But I am too lazy to write both. So shell it will be.
#!/bin/bash
user='root'
pwd='Very53cur3!'
host='192.168.8.1'
There is only one user on the router. So the username should be the same. But i hope your password differs from mine. The IP is the default IP.
asn=$(curl -X POST -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"challenge","params": {"username": "'$user'"},"id": 0}' http://$host/rpc -s )
alg=$(jq -n "$asn" | jq '.result.alg' | tr -d '"')
salt=$(jq -n "$asn" | jq '.result.salt' | tr -d '"')
nonce=$(jq -n "$asn" | jq '.result.nonce' | tr -d '"')
The first request is against the API with your known username. It could be hardcoded root. But no. ... This request will get you the used algorithm, the salt and the nonce. And split it.
saltedpwd=$(openssl passwd -1 -salt "$salt" "$pwd")
An attacker could sniff the whole conversation and get the salt before, it could be less secure. But the above written password is not send at any time in clear text!
hash=$(echo -n "$user:$saltedpwd:$nonce" | md5sum | cut -d' ' -f1)
sid=$(curl -X POST -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"login","params": {"username": "'$username'", "hash": "'$hash'"},"id": 0}' http://$host/rpc -s | jq '.result.sid' | tr -d '"')
Do your API things:
curl -X POST -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"call","params":["'$sid'", ... some JSON jibber jabber ... ],"id": 0}' http://$host/rpc -s
I hope this helps as a start ...
Ah, don't forget the timings ... If I remember correct, the first 3 steps needs to be done in 2000ms, the final request could take a little longer.
