Actions
Defect #41282
open
Request to csv url should be an @api_request@
Status:
New
Priority:
Normal
Assignee:
-
Category:
REST API
Target version:
-
Resolution:
Affected version:
Description
We have an access filter plugin implemented in https://github.com/MEDEVIT/redmine_access_filters which differentiates
between web and api calls.
Now I do a call to the url /projects/myproct/issues.csv which directly returns a CSV file via the API.
Due to https://github.com/redmine/redmine/blob/52deba3abf4753777d189b379df3acec723c7bce/app/controllers/application_controller.rb#L715csv endings are not classified as being api calls.
Is there a specific reason for this? In my opionen a direct call to both .json, .xml and .csv should be considered as api calls.
Updated by Go MAEDA 7 days ago
I do not think CSV should be treated as an API request, for the following reasons.
- CSV export is a Web UI feature. Its column headers are translated labels, and the decimal separator, encoding, and field separator depend on the user's language and export options. In contrast, the JSON and XML responses use fixed, locale-independent field names.
- Treating CSV as an API format would raise the same question for PDF and Atom. Atom already has its own key-based authentication, separate from the REST API. Changing this classification would require a broader design discussion about consistency.
Actions