suggestion: use share key for api authentication

[bo0tzz]

The last part of a share link (/share/<key>) can be used for API auth by appending it to the url (immich.local/api/foo?key=j3lij2w34892etc). It's probably not a straight swap (I don't know what endpoints you use right now, and the share key is limited) but in theory this should let you remove the need for an API key entirely, reducing the attack surface even more.

[alangrainger]

I think you're thinking of the endpoints to get asset info, like viewAsset. But to find out what assets are included in a particular share link, I need to use getAllSharedLinks, which requires an API key to access.

But if there's another way to find out what assets are associated with a given share link (share key), I'd love to know, as using getAllSharedLinks seems really inefficient since I have to request all links and then iterate them.

[bo0tzz]

I'm not sure why it's called this, but /api/shared-links/me?key=asdf returns the share link details.

[alangrainger]

You LEGEND!!! I have no idea why it's called that either, but that is exactly what I was looking for!

I will refactor to use that and remove API key completely. Thank you!! ❤️

[alangrainger]

API key has now been removed - thank you very much @bo0tzz

0304b0b

[bo0tzz]

Awesome! :D