API Key Unsets Itself?

  • Resolved scartinh

    (@scartinh)


    7 years, 5 months ago

    I am working on a website at SiteGround that is not yet public (login required). I decided to install the Sucuri plugin and activated it successfully. I obtained an API key, entered it, and everything seemed fine. For example, I receive email notifications when I log in or make content changes.

    However, the key disappears spontaneously over the course of hours or a few days. That is, under Sucuri settings, I will find the message “API Key: (not set)” in red.

    Each time this happens, I recover the key by email, follow the instructions to submit it, and it appears to be accepted. The API status box turns from red to green.

    But perhaps only a few hours later, I will again find “API Key: (not set)”.

    It does not happen each time I log in. Over the course of a day, I might log in several times and peek at the API key status to make sure all is well. But eventually the red message appears — after a few hours, or maybe a day or two.

    Does this occur because I’m using the free version of the plugin?

    Thank you —

Viewing 6 replies - 1 through 6 (of 6 total)

  • The deletion of the API key is caused by a response from the API service that reports the non-existence of a file that is used to store the security logs. Because this file is created during the generation of the key, the API assumes that if the file doesn’t exists is because the key was never generated. The plugin proceeds to delete the key as it “appears” to be invalid.

    This is not a bug in the plugin, the plugin is simply reacting to the information that the API service is returning. The problem is in the server that is hosting the API, and I have no control over that machine for security reasons. I will send this to my project manager so the maintainer of the API can fix the bug.

    Meanwhile, you can do this:

    1. Use (S)FTP or the file manager to access your server,
    2. Find and open this file [1] using a code editor,
    3. Jump to line 292 and locate this piece of code [2],
    4. Delete that line and save the changes

    This should stop the plugin from deleting the API key on HTTP failures.

    [1] /wp-content/plugins/sucuri-scanner/src/api.lib.php
    [2] SucuriScanOption::deleteOption(':api_key');

    Hello @scartinh I already worked on this case, the fix is already in our development repository [1], but I cannot release a new version of the plugin before the QA testing is finished, my co-workers are still reviewing the changes, not only for this bug but also for other things that we decided to modify since the last version.

    Feel free to install the development version of the plugin for now [2].

    [1] https://github.com/cixtor/sucuri-wordpress-plugin/commit/acae69d
    [2] https://github.com/cixtor/sucuri-wordpress-plugin

    Thread Starter scartinh

    (@scartinh)

    Thank you very much for this update and for the link to the development version.

    And also, thank you for the modification you described in your first email — the API key is now persisting.

    My Site is doing the same thing, any suggestions for me?

    • This reply was modified 6 years, 11 months ago by brian7974.

    Same issue for me. I also have a SiteGround install but it is public. I set the API key and I receive the email confirmation saying it was successfully applied. However, in Sucuri > Settings it still says “API Key: (not set)”.

    The original solution to delete a line of code is not relevant any more as this code line does not exist.

    I checked file permissions for the plugin directory and they are set correctly.

    I have many other installs which are working fine. Just this one that is causing a problem.

    I contacted Sucuri support and they assisted resolving the issue.

    This was their response which solved the problem:

    I deactivated all your plugins besides Sucuri plugin and I was able to insert the key. One of the plugins is preventing Sucuri’s plugin from writing into the configuration file, so if you need to change a setting on Sucuri plugin you may need to disable all plugins like I did besides Sucuri or find which plugin is causing the issue.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘API Key Unsets Itself?’ is closed to new replies.