# Bug OP-19109 - POST/PATCH/DELETE requests to APIv3 return unauthorized

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-19109

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | API |
| Target versions | 17.5.0 |
| Observed in versions | 17.2.0 |
| Sprint |  |
| Backlog bucket |  |
| Bug found in version (deprecated) | 17.2.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Jan Sandbrink |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Log in to OpenProject

2.  Go to `/api/docs`

3.  Search for an endpoint that requires a non-GET method to be reached
    
    1.  e.g. `/api/docs#?route=patch-/api/v3/work_packages/-id-`

4.  Fill in required request parameters and "Execute" the request

Alternatively/Generally: Perform a request towards APIv3, using session authentication with a non-GET request method.

### What is the buggy behavior?

  - The request fails, unless the non-standard X-Requested-With header is present
    
      - this header is no present for calls made via `/api/docs`

Explanation: The intention behind the header-check seems to be to ensure that the request is not performed cross-origin and thus, that no unauthorized parties could cause the user's browser to make a request that has side-effects.

### What is the expected behavior?

  - Executing requests from `/api/docs` works regardless of request method

  - Cross-Origin validation of requests is ensured in a way that's broadly supported across browsers, regardless of how exactly the requests are implemented.

### 

### Environment information

**OpenProject version**

*17.2*

**Browser**

- [ ] Chrome
- [x] Firefox
- [ ] Safari
- [ ] Mobile Safari
- [ ] Other (please specify)