How to POST an issue stub on GitHub using the GitHub API using the logged in user, without authentification keys?

user_398963 0
Viewed 173

Users of my web application are expected to provide bug reports as a GitHub issue, with a pregenerated title and body.

This works perfectly fine using GET for small bodies:

const title = getLastErrorTitle();
const body = getAllTheLogMessages();
window.open(`https://github.com/theuser/therepo/issues/new?title=${encodeURIComponent(title)}&body=${encodeURIComponent(body)}`);

If the user is logged in, GitHub presents the user with a new issue with the title and body already filled out, perfect. If not, GitHub prompts the user to log in and it works the next time.

However, if the body is too large, the GET request fails because the URL becomes too long.

After consulting the manual I tried doing the same with POST but I get a 404 from GitHub with the following test request (jQuery for brevity):

 $.ajax({
  type: "POST",
  url: "https://api.github.com/repos/theuser/therepo/issues",
  data: data = {title: "Test", body: "Test Body"},
});

My suspicion is, that the GitHub API was not designed with my use case in mind, but that POST always requires authentication and creates the full issue in one go, without letting the user change it beforehand like it is possible with GET.

How can I transfer the functionality of the GET method over to the POST method? I just want GitHub to present the user, that is currently logged in inside the browser, with a prefilled issue, without needing a token.

github-api post api github javascript
2 Answers

You can't. Otherwise, it would be a major CSRF exploit.

However, you can use OAuth authentication that will allow your application to use some features : https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/

Or simply, redirect the user to a new issue page (for exemple with a simple HTML link <a>) with some automatic content, using this pattern : 

https://github.com/{theUser}/{theRepo}/issues/new?body={theContentYouWhant}&title={theTitleYouWhant}

Example : https://github.com/CristalTeam/php-api-wrapper/issues/new?body=Hi,%20this%20is%20the%20body%20you%20want&title=Hello,%20this%20is%20a%20prefill%20issue

user_135699270

What I would suggest here is to generate a personal_auth_token at gihub and pass this token in the headers under Authorization field.

To generate personal_auth_token, login to github.com, go to settings -> developers settings -> Personal access tokens and generate one.

Pass this token in headers under Auhtorization: token. So in your AJAX request, it could look something like this:

$.ajax({
    url: *yourUrl*
    ...
    beforeSend: function (xhr) {
        xhr.setRequestHeader('Authorization', *token*));
    },
});

One thing to note here is each of the developers POSTing to the repo will be requiring to generate their access token and you can't push this token on to a public Github repository because of obvious security breach. If you accidentally do so, the token is revoked immediately and you'll be required to create a new one.

user_46509750
Related