I have never worked with another Third Party System before that prefers to push data to me than provide an API to just pull that data down as needed - but they have their reasons they say!

On that basis they say they typically use a basic method of the client providing a form to which they post the data each time. Now this means they post direct to the form submission URL - so my initial thought was channel forms - but then i remembered XSS and how this will prevent it. So is there a way to disable XSS token checks specifically for a single form, or just site wide (which i would prefer to avoid).

If not - i will use addon to create a REST api on the EE end and get them to submit to that. Does anyone have any experience with such a addon as: http://docs.reinos.nl/webservice/#introduction

Thanks, N


In this case, the POST submission would be rejected not due to XSS, but CSRF. It's not an appropriate API to use for continuous submission from an external source.

I haven't used Reinos' add-on, but depending on the third-party's flexibility, their aptitude, and your custom field requirements, it's possible that your needs would be covered by the native Metaweblog API. You would install it and configure a specific endpoint for them to use. They would send a Metaweblog API compatible request to that URL, which would be exempted from CSRF protection, and use its own authentication.

  • Really good point. I did not think to try that. Trying out Reinos add-on and it seems very good indeed so far. But will try this too. Thanks Mr Jones Feb 18 '17 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.