Optionally allow OAuth signing of all API requests

[zerebubuth@…]

One frequent complaint when large mapping parties are held behind NAT firewalls is that API requests begin to fail with "509 Bandwith Limit Exceeded" messages. This is due to the OSM API rate-limiting on the basis of the user's IP address, which may be shared with many other users.

A method was recently committed and deployed to the API which means that OAuth signed requests will count towards a per-user rate limit rather than a per-IP one. This should mostly solve the problem that users behind NAT firewalls have experienced. While it is not necessary to use OAuth to sign read-only requests, such as map API calls, doing so will cause the user to be judged on their own traffic alone.

iD has added support recently, for full details please see: ​https://github.com/openstreetmap/iD/pull/3519

For background about the problem, please see: ​https://github.com/openstreetmap/operations/issues/36

[anonymous]

While it is not necessary to use OAuth to sign read-only requests, such as map API calls, doing so will cause the user to be judged on their own traffic alone.

Trying to explain this better. What I meant was:

• The API behaviour is not changing with respect to requiring authentication. It will not be required to use OAuth on any API calls.
• However, using authentication on API calls will allow the server to know the user's ID and calculate the rate limit for the user. Otherwise it will calculate the rate limit for the user's IP address.

[wiktorn]

Maybe such a patch is sufficient:

src/org/openstreetmap/josm/io/OsmServerReader.java

@@ -28 +28 @@
  */
 public abstract class OsmServerReader extends OsmConnection {
     private final OsmApi api = OsmApi.getOsmApi();
-    private boolean doAuthenticate;
+    private boolean doAuthenticate = "oauth".equals(OsmApi.getAuthMethod());
     protected boolean gpxParsedProperly;
 
     /**

[Don-vip]

In 11193/josm:

fix #13872 - OAuth signing of all API requests to support user-based bandwith limit instead of IP-based one (based on patch by wiktorn)

[bastiK]

Use new preference directory and download data -> The OAuth dialog will pop up and request username and password.

It should just download the data and only authenticate the request when OAuth is already configured.

[Don-vip]

In 11194/josm:

fix #13872 - use authentication only if OAuth is configured properly

[zerebubuth@…]

Thanks! That was very quick.

I've just tested this and it seems to be having the intended effect server-side; map downloads were assigned to my user ID rather than my IP address.

[simon04]

In 16422/josm:

fix #18820, see #13872 - Make OAuth signing of all API requests configurable