Not sure if this is a bug or if I’m doing something wrong but basically every time I make a REST api call to a mikrotik device, it creates a new active user, that seems to linger forever. At the moment I have about a hundred active users. I’ve tested this with 7.14.3 and 7.15rc1, same thing for both.
I want to say it used say “api” for via, not “(unknown)” - so that’s also not right here.
When you say “forever”, so you mean longer than 2 minutes. AFAIK REST API is just a proxy layer over the native API, and that api uses sessions… so reasonable it stick around for REST timeout plus some extra to avoid re-auth to native API for subsequent stateless HTTP REST API requests.
But >5 minutes would seem to be a bug, likely even shorter than that too.
Yes, a lot longer than 5 minutes, those logins are hours old, also, it does create an api user too (only one as far as I’ve seen), but the unknowns just keep adding up.
I don’t see multiple ones, but I only tested from my laptop, so only one remote IP. I’ll check tomorrow and see if it’s still there since this router doesn’t (or shouldn’t) get any REST API calls.
Ah, sorry forgot to mention that all my users are from the same ip too. A new user is created every 10 minutes, I think that that is the interval of the keep-alive in the rest api (a new connection created every 10 minutes).
I think something's still not working here.
If you create a user with REST API rights and without API rights, when you try to make a request, you'll see a REST API connection error in the logs.
If you create a user with both REST API and API rights and make a request to the router, you'll see a successful API connection in the logs, but two entries in the active users list—the same user connected via both API and REST API. The API user will time out if they have a logout activity rule configured, but the REST API user will remain logged indefinitely; they don't know anything about timeouts.
