H MP Co n f igu ra tio n AP I - S p in e tiX Te ch n ica l Do cu me n ta tion v3 .1
© S p in e tiX S A A ll rig h ts re se rve d .
P a g e 4 3 of 5 8
<secure-monitoring>no</secure-monitoring>
<rpc-api-key>
HMP100, HMP130, HMP200, HMP350 only
Added in 3.4 and 4.2 firmware release
The RPC API key protects the HMP against CSRF (Cross-site request forgery) when using CORS (Cross-
origin resource sharing). When doing an RPC request using AJAX from a web page located on another
host, i.e. using CORS, an additional query string parameter
spx-api-key
must be present in the
request and the content of the query must be set to the value of the
<rpc-api-key>
, i.e
/rpc?spx-
api-key=[rpc-api-key]
.
It is possible to clear the
<rpc-api-key>
, in this case CORS RPC request are not possible. This is the
default setting of the HMP.
To clear the RPC API key use the following:
<rpc-api-key/>
To set an RPC API key it is recommending to use an UUID (Universally unique identifier) which cannot
be guessed by a potential attacker.
For instance, if the UUID is e81e1111-c393-48d5-b8f1-1f1df5e31935, then the following should be
used to configure the RPC API key:
<rpc-api-key>e81e1111-c393-48d5-b8f1-1f1df5e31935</rpc-api-key>