Accessing 'members/api/member' from external website to check if user logged in

bugsysailor · March 3, 2025, 4:54pm

I’m trying to access ...com/memebers/api/member from an external website to show/hide gated content on another site.

I’ve updated the CORS settings to accept requests from the given domain, but continue to receive a 204 error.

After some further digging I looked into the members middleware.js file if there were any solutions and wondering the responses is being blocked in the cored .js code.

AND/OR is this even possible?

I’m brand new to Ghost, and really crossing my fingers that this can be the long term membership solution I’m looking for. This is the last hurdle that would make Ghost my solution of choice.

Any advice would be helpful.

Thank you.

Cathy_Sarisky · March 3, 2025, 5:11pm

Can you say a little more about your flow? Where are requests coming from/to?

From memory when I did this last, I think I had js running in the browser on the Ghost site that made a post to the non-Ghost site (whose CORS settings you hopefully control?), and then the back end on the non-Ghost site did the validation by talking to the Ghost api.

bugsysailor · March 3, 2025, 5:28pm

Attempting to send a request via Netlify function on the external website to members/api/member

I have ghost installed through Digital Ocean, so have fun control of CORS on both ends.

I have verified that I’m logged into the Ghost website as a user and can successfully access members/api/member in the browser but continue to get a 204 response making requests.

Cathy_Sarisky · March 3, 2025, 8:10pm

Yeah, that’s not going to work unless you’ve somehow got the user’s cookie.

Instead, send the user to Ghost, have their browser get the result of /members/api/session/ and post it to your other server. Your other server can get the key for validating the jwt from /members/.well-known/jwks.json, and check that what the user’s browser has sent is correct. Then your other server can return a token/cookie that your other server uses to get them logged in.

bugsysailor · March 3, 2025, 8:14pm

Unfortunately, this is a little beyond me. Is there a working example you know of or some starter code that might get me on my way?

vikaspotluri123 · March 4, 2025, 2:25am

Here’s an example from DoG:

Client - send the JWT to the server

github.com/vikaspotluri123/discourse-on-ghost

landing-pages/jwt-auth.hbs

9f1f85296


      
          			const jwt = await fetch(siteUrl + '/members/api/session/').then(response => response.text());
          
          			await fetch(authUrl.href, {
          				credentials: 'omit',
          				headers: {
          					authorization: `GhostMember ${jwt}`
          				},
          			}).then(async response => {

Server - fetch keys:

github.com/vikaspotluri123/discourse-on-ghost

src/services/ghost.ts

9f1f85296


      
          	private async _getJwtKeys() {
          		const endpoint = this.resolvePublic('/members/.well-known/jwks.json');
          		const response = await this._fetch(endpoint);
          		const {keys} = await response.json() as {keys: JsonWebKey[]};
          
          		// eslint-disable-next-line unicorn/no-array-callback-reference
          		this._ghostMembersPublicKeys = keys.map(simplifyJwk);
          	}

Server - verify JWT:

github.com/vikaspotluri123/discourse-on-ghost

src/services/ghost.ts

9f1f85296


      
          	decodeMemberJwt(jwt: string) {
          		return new Promise<{success: true; payload: string} | {success: false; error: unknown}>(resolve => {
          			jsonwebtoken.verify(jwt, this._getKey, {algorithms: ['RS512'], issuer: this._jwtIssuer}, (error, payload) => {
          				// eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
          				if (error || !payload) {
          					resolve({success: false, error});
          					return;
          				}
          
          				resolve({success: true, payload: payload.sub as string});
          			});
          		});
          	}

Server - using the member email to get the member details:

github.com/vikaspotluri123/discourse-on-ghost

src/controllers/sso.ts

9f1f85296


      
          			return;
          		}
          
          		const rawDiscoursePayload = await this.decodeDiscoursePayload(sso, sig);
          
          		if (!rawDiscoursePayload) {
          			response.status(400).json({message: 'Unable to verify signature'});
          			return;
          		}
          
          		const email = decodedJwt.payload;
          		const member = await this._ghostService.getMemberByEmail(email);
          
          		if (!member || member.email !== email) {
          			response.status(404).json({message: 'Unable to authenticate member'});
          			return;
          		}
          
          		const discourseRedirect = rawDiscoursePayload.get('return_sso_url')!;
          		const memberPayload = this.convertGhostMemberToDiscourseSSO(member, rawDiscoursePayload.get('nonce')!);

Topic		Replies	Views
Using Ghost Portal on external site? Integrations & API	2	35	February 6, 2025
Integrating LOGIN API failed? URGENT FIXED Integrations & API	9	447	August 29, 2023
Authenticating API for users Integrations & API	4	1127	February 17, 2023
Ghost url api cors error Themes	5	2485	January 21, 2019
User Authentication (Session based) on Ghost (Pro)? Integrations & API	3	665	July 22, 2023

Accessing 'members/api/member' from external website to check if user logged in

Related topics