4

Ah, that one remains. Is that a bug or a “feature”?

5

am i supposed to also guess which status code you were expecting and why?

6

401 Unauthorized - HTTP | MDN UNAUTHORIZED would have been my expectation. At least anything larger than 299 to indicate an error.

7

i guess this makes some amount of sense but that’s not how api returns its errors. :man_shrugging:

8

Alright, in case of some future work on the API this might be a nice change to introduce.

9

tt-rss accepted base64 encoded password for at least 9 years. Why would the feature be just dropped?

10

because it’s stupid and pointless? i don’t remember why was it even there in the first place but my guess would be an incompetent client developer, most likely of this very app you’re using.

i’m normally not one to shit on other foss projects (except samba and xorg) but this “ttrss-reader” was so absolutely fucking terrible at everything that i literally taught myself android development from fucking scratch to make my own client that didn’t suck just so much.

11

Your own app states - TRIAL. Does it mean it will work for a limited amount of time or some features are disabled?

12

go be an idiot somewhere else, thx

13

I noticed this error today when trying to use ios app Fiery Feeds 2.4.12 Build 308. Fiery Feeds has worked well for months or years but today fails to log in. I tried setting a new password in ttrss and fiery feeds, but that didn’t help. TT-RSS runs in docker, v21.03-fcce1c4. TT-RSS has this in its log:

Failed login attempt for admin (service: _api) from 172.24.0.10

Forwarded For: [my ip]
Forwarded Protocol: https
Remote IP: 172.24.0.10
Request URI: /tt-rss/api/
User agent: Fiery Feeds/2.4.12 (iPhone; iOS 14.4; Scale/2.00)

14

I agree with MiF that removing a feature like this should at least be mentioned somewhere, preferably well in advance, since it is a potentially breaking change. Thanks for cleaning up the clutter though and making things more secure.

15

what, again with the base64?

https://git.tt-rss.org/fox/tt-rss/wiki/ApiReference#login

can you please point me where base64-encoded passwords are mentioned on this page?

16

I don’t know what the cause of the login failure is with Fiery Feeds, whether it’s a base64 issue or not. I just wanted to point out that it’s not just the TT-RSS Reader app that’s suddenly having login failures.

17

most likely the same thing. i don’t know who copypasted who but i’m fairly certain that actual api documentation never mentioned this, it was a thing specifically done for Nils because he asked for whatever reason. and it was there for 10 years, yes. until it suddenly wasn’t.

API discussion - Tiny Tiny RSS here’s the actual discussion

e: that part of login code has bothered me for years until i refactored the whole thing this spring (is it spring yet? its snowing outside). so sue me, etc.

18

I am using the same version of Fiery Feeds and have not had any login issues. Apparently, this only happens when using the account password. I am using an app password and Fiery Feeds works fine. The specific commit that breaks Fiery Feeds sync with the account password is 580eccd3da. I’m pretty sure base64 encoding has nothing to do with this.

19

that’s interesting, does it rapidly login multiple times? well, you always disable this check altogether or use an app password which is excluded from it (for the time being).

see, you’re doing the right thing already.

20

Yeah, I generally use 2fa when available. Even with last night’s security issue OTP on its own wasn’t really less secure than just password auth.

Looking at nginx access logs I saw about 13 POST requests for a single refresh of all articles within about two seconds and multiple “Too many authentication attempts for test, throttled” log entries, so that’s most likely the cause.

21

you’re (well, not you specifically, an api consumer) is supposed to login as necessary and otherwise maintain a single login session. not only logging in for every request bloats up tt-rss sessions database, it’s simply terrible application design.

22

TT-RSS has app passwords?! I just hunted it down, implemented that, and it fixed the problem with my Fiery Feeds. Thank you.

23
...