shift-org / shift-org/shift-docs
API - accept event secret as request header
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 30
- Forks
- 25
- Avg merge
- 9m
- Merged PRs (30d)
- 1
Description
Endpoints used by an event organizer to manage their listing provide the event secret in 2 ways:
- In the request body:
manage_event, when updating a listingdelete_event, when deleting a listing
- As a URL param:
retrieve_event, when retrieving all listing details (including private fields)
(When creating a new listing via manage_event, the secret is not needed.)
Sending in the request body is OK, but we should also allow it to be sent as a request header (and discourage URL param usage).
Note that we don't currently send the secret in the retrieve_event or manage_event response body, even when a valid secret was provided in the user's request.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies the manage_event, delete_event, and retrieve_event endpoints and their current secret locations. Start by locating the endpoint documentation or handlers and trace how each reads the secret. Done means header input is accepted, body input still works, URL parameters are discouraged, and responses do not expose the secret.
Written by the indexing model from the issue text.
Assessment
- Domain
- api
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100