3

I have been using monero-wallet-rpc with --disable-rpc-login so far with success, but would like to start authenticating my calls. Can someone please post what the username and password fields are defined as? I tried curl:

curl -X POST http://<username>:<password>@127.0.0.1:18082/json_rpc -d '{"jsonrpc":"2.0","id":"0","method":"getbalance"}' -H 'Content-Type: application/json'

(where <username> is my username) and also the python requests library using parameters 'username' and 'password' in my payload but had no joy. Also I'd ideally just like to point at the password file autogenerated by monero-wallet-rpc rather than having to read it etc. Any help in this direction would be really appreciated, thanks! I also see sporadic talk online of a 'user agent' ... any documentation of this at all?

  • Would giving username/password by -u option and adding --digest to the command line help? – kenshi84 Jan 31 '17 at 4:44
  • @kenshi84 u mean to the command line args that kickoff the rpc server? Any tips on using --digest ? just add the filepath+name after ? Also I don't see either of these in --help for monero-wallet-rpc – kumarz Jan 31 '17 at 13:50
  • No, it's an option for curl. Sorry for being unclear. – kenshi84 Jan 31 '17 at 14:28
2

As @kenshi mentioned, --digest needs to be added to the curl command. The default behavior for curl is to attempt basic authentication, then abort. I have personally attempted curl with monero-wallet-rpc, so it should work.

The password file is always written to the same directory where monero-wallet-rpc was started. The filename is always monero-wallet-rpc.[port].login where [port] is the port number of the RPC server. The file is only readable by the local user account that started monero-wallet-rpc. The format for the file is [username]:[password] - in other words the first colon separates the username from the password.

Lastly, you have to read from the file. The purpose is proving that your application can read a file only readable by the same local user account that is running monero-wallet-rpc. Pointing to the file provides no proof of authorization.

  • 'Pointing to the file provides no proof of authorization' ... the file (monero-wallet-rpc.[port].login) contains my username and login, not good enough? So anyway, I can't pass that file in my curl command huh... – kumarz Feb 1 '17 at 0:26
  • If you want to pass the contents of the file in the curl command, then that is sufficient. But if you want to pass the filename in the curl command, then it serves no purpose. The RPC server wrote the file, so it knows the contents, its the client that needs to prove that it also knows the contents. – Lee Clagett Feb 1 '17 at 0:30
  • @kumarz Sorry I misunderstood your question. curl does not allow you to pass a file for the username/password. But bash can do this for you curl -u `cat monero-wallet-rpc.30000.login` --digest http://localhost:30000/json_rpc -d '{"jsonrpc":"2.0","id":"0","method":"getbalance"}' -H 'Content-Type: application/json'. The backticks are important, it runs the command first then dumps the output of that command into the curl command. – Lee Clagett Feb 1 '17 at 1:56
  • aha! now we're cookin! alas the [current source is not building correctly][1] so I am using the [pre-built binaries][2] which don't feature this authentication yet, so I'll accept your answer once I've properly tested this: hope that's cool [1]: github.com/monero-project/monero/issues/… [2]: getmonero.org/downloads – kumarz Feb 1 '17 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.