Advanced REST client application: security

Showing posts with label security. Show all posts

Monday, 18 January 2016

ARC reborned

Hi developers,

For past 2 years I haven't been very productive developing the app. There was a lot of things going on in my life (work, study) and eventually I haven't got time to develop the app. Well, this is about to change.

For a last two months I moved the project forward. Source code is now available on GitHub and all issues has been moved there as well. I started working on app's improvements and there is a lot to do. So probably you'll be happy to hear that I'm developing the app full time now!

Google Drive permissions - Why the app need them?

Hi all,

Recently I've received an email from one of you. Someone asked me why do I need those permissions to connect to Google Drive. Well, below is my answer:

My app is using following scopes for Google Drive:
a) https://www.googleapis.com/auth/drive.install
b) https://www.googleapis.com/auth/drive.file
c) https://www.googleapis.com/auth/drive.readonly.metadata

The first permission "drive.install" is required for apps that want to install itself to users Google Drive. Thanks to this permission you can use option "Open as" and then "Advanced Rest Client" from file context menu. It is one of planned functions in the app and it do not influence any file on Google Drive.

Permission b) is required to open/save file on Drive, but only created by the application.

And finally c) it is required to retrieve list of folders from your drive. It is used when you want to save your file on the Drive. Otherwise the application is only able to save file on root folder. From UX perspective it is not recommended to remove this functionality. Also note, this permission does not allow any access to read or download file content.

More about scopes you can read at https://developers.google.com/drive/scopes. You can check https://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClient/war/drive.js file to know how the app is integrated with Google Drive.

I'm not planning to change permissions scope. At least until Google introduce Google Folder Picker. For now Drive Picker allows only to pick up a file and I need to pickup a directory.

(end of response)

You are welcome to email me about your concerns or if you have some great idea for the app. I'm always reading your emails (or issues on Goggle code).

Happy RESTing!

Sunday, 30 September 2012

Why do I need "history" permissions?

Well, It's quite simple.
When you start typing a URL, the application doing two things: search application history for given URL and query browsers history.
Searching application history is obvious. But chrome history is not.
In fact it just query your history with query you entered to URL field and displays results in suggestions dialog.

If you ever visits this url it will be displayed in list so you can your job faster :) I know that probably you just paste URL in this field but I think is a good feature anyway. It do nothing else with your data. You can check trunk to see what it actually doing with history data: http://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClient/src/org/rest/client/suggestion/UrlsSuggestOracle.java

Cheers!

Saturday, 14 January 2012

New permissions - re-enable your application

As you may noticed lately an application has been disabled by Chrome browser. I'ts because I've changed permissions for application. I've added "history" permission to application to make typing URL easier.

Prior current version you had to type all URL manually. Now using history API application can recognize URL you want to type and suggest it (if you had visited this URL earlier).

I hope you appreciate new change.

As always you can check source code to make sure you history is not misused:
revision change: http://code.google.com/p/chrome-rest-client/source/detail?r=109
history usage: http://code.google.com/p/chrome-rest-client/source/browse/trunk/RestClientApp/src/com/restclient/client/storage/UrlsSuggestOracle.java
API access: