Advanced REST client application: permissions

Showing posts with label permissions. Show all posts

Monday, 18 January 2016

ARC reborned

Hi developers,

For past 2 years I haven't been very productive developing the app. There was a lot of things going on in my life (work, study) and eventually I haven't got time to develop the app. Well, this is about to change.

For a last two months I moved the project forward. Source code is now available on GitHub and all issues has been moved there as well. I started working on app's improvements and there is a lot to do. So probably you'll be happy to hear that I'm developing the app full time now!

Google Drive permissions - Why the app need them?

Hi all,

Recently I've received an email from one of you. Someone asked me why do I need those permissions to connect to Google Drive. Well, below is my answer:

My app is using following scopes for Google Drive:
a) https://www.googleapis.com/auth/drive.install
b) https://www.googleapis.com/auth/drive.file
c) https://www.googleapis.com/auth/drive.readonly.metadata

The first permission "drive.install" is required for apps that want to install itself to users Google Drive. Thanks to this permission you can use option "Open as" and then "Advanced Rest Client" from file context menu. It is one of planned functions in the app and it do not influence any file on Google Drive.

Permission b) is required to open/save file on Drive, but only created by the application.

And finally c) it is required to retrieve list of folders from your drive. It is used when you want to save your file on the Drive. Otherwise the application is only able to save file on root folder. From UX perspective it is not recommended to remove this functionality. Also note, this permission does not allow any access to read or download file content.

More about scopes you can read at https://developers.google.com/drive/scopes. You can check https://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClient/war/drive.js file to know how the app is integrated with Google Drive.

I'm not planning to change permissions scope. At least until Google introduce Google Folder Picker. For now Drive Picker allows only to pick up a file and I need to pickup a directory.

(end of response)

You are welcome to email me about your concerns or if you have some great idea for the app. I'm always reading your emails (or issues on Goggle code).

Happy RESTing!

Sunday, 30 September 2012

Why do I need "history" permissions?

Well, It's quite simple.
When you start typing a URL, the application doing two things: search application history for given URL and query browsers history.
Searching application history is obvious. But chrome history is not.
In fact it just query your history with query you entered to URL field and displays results in suggestions dialog.

If you ever visits this url it will be displayed in list so you can your job faster :) I know that probably you just paste URL in this field but I think is a good feature anyway. It do nothing else with your data. You can check trunk to see what it actually doing with history data: http://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClient/src/org/rest/client/suggestion/UrlsSuggestOracle.java

Cheers!

Friday, 21 September 2012

It's almost here! New version of Advanced Rest Client

Hi all!

I'd like to inform you that new version of the application is almost ready :)
It took over 3 months but the application was written from scratch. Now it can do a lot more than current version. Thanks for all who submit an issue on http://code.google.com/p/chrome-rest-client/issues/list and helps me improve application.

Note:
There is a number of new permissions required by the application. See bottom of this post for more info.

Let's start from UI.

New version UI

UI now have more modern look. It is not very different from current version, but devil is in the details. Have you noticed that there is new option in menu?

Projects is a new feature. It helps you organize saved requests and you can easily switch between requests sharing it's parameters. More about projects you can find in my previous post.

Project view

OK, let's make a HTTP request:

Still it is not very different form previous version. But as you can see I've added new section to response view. Now Request Headers are also available in application view. And there is more.
Since now you can overwrite browsers headers that are not available for regular XmlHttpRequest! This mean that you can set User-Agent, Accept and many more headers. It becomes possible since new declarativeWebRequest API in Chrome. And here is the bad news. For today it is only available for Chrome Dev Channel (version 23). It will take about 3 months before it becomes available in stable version. Since then I'll send an update to Web Store but it will be available for version 23+.

Let's go on. Lately someone suggest that application should show redirect chain (issiue 67). Well, here it is:

It will show complete request flow. For each redirect it collects information about received headers, status and information is this redirection comes from cache (f.e. HTTP 301) or not.

I've made some improvements to request form panel. You can "open" url input field and create URL using form:

When you need to encode query parameters just pres "enc" button for this parameter. If you need to encode parameter but replace + with %20 just hold CTRL key.

There are changes in settings section as well. First at all "cookies capture" is no more experimental. Well, it is not working very well right now. Results may vary and you can't rely on it. But since application can show all response headers (even those invisible to the XmlHttpRequest object) you can see cookie data in response panel.

There is no JSON headers settings. This is fixed now and list contain all popular json headers definitions.

Important change for the application is import/export options. Since now export to application server is deprecated and this option will be removed December 1st, 2012.

There are better options for import export. First is export to file. Application will generate json file with projects and requests definitions. You can easily change it's content and send file to collaborators. Thanks to this change you don't need to be worry about data sent to application server.

Next step it to implement Google Drive API to save file directly on your drive. Then the application becomes one of the Google Drive applications.

There is a number of new permissions required by application.

webRequest

This is required to observe and analyze traffic - to know when redirect occur and to catch request and response headers

declarativeWebRequest

This is required to modify request headers by XmlHttpRequest (to remove or add headers)

background

To achieve points above. It is also required to communicate with other extensions.

storage

Chrome provides API for sync data. Application will synchronize some settings like debug and history options.

history (not changed) is required by URL widget to provide fill support. While typing an URL it search application's and browser's history. When it find matches it will return it in suggestions list. Browser's history is not stored in application.
<all_urls> (not changed) is required by application to make any request outside application sandbox.
cookies permission has been removed

I hope you like changes and you will like new version of the application. Update will become available in next few weeks. Since then you still can report an issue if you found some :)

Cheers!

Saturday, 14 January 2012

New permissions - re-enable your application

As you may noticed lately an application has been disabled by Chrome browser. I'ts because I've changed permissions for application. I've added "history" permission to application to make typing URL easier.

Prior current version you had to type all URL manually. Now using history API application can recognize URL you want to type and suggest it (if you had visited this URL earlier).

I hope you appreciate new change.

As always you can check source code to make sure you history is not misused:
revision change: http://code.google.com/p/chrome-rest-client/source/detail?r=109
history usage: http://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClientApp/src/com/restclient/client/storage/UrlsSuggestOracle.java
API access: