Feed icon gone

[aab3r]

Describe the bug
The feed icon in the top bar is gone.

To Reproduce
Steps to reproduce the behavior:
I had "Master authentication token" enabled, so I could share feeds. After upgrading today (March 5 2024), the icon is gone. The shared feed links seem to be still working, though.

I can see there's an API password in profile (I don't know if it was there before); if I enable it, I'm able to share a rss link of an user query (nice), but I'd like to keep offering rss links of individual channels.

Expected behavior
I didn't expect the feed icon to dissapear.

Screenshots
Screenshot attached.

Environment information (please complete the following information):

• Device: Server
• OS: Debian 12
• Browser: Firefox / Chrome
• FreshRSS version: 1.23.2-dev
• Database version: Mariadb 10.11.6
• PHP version: 8.2.7
• Installation type: Git

[Alkarex]

Hello,
This is by design. The former approach of using the same token for everything is not safe enough, as some user might share those feeds (which were intended for internal use) with third parties. Due to being the same token, a third party knowing the token can access any feed of the FreshRSS instance and do other actions.

So the current solution is to use user queries.
You can still share an RSS feeds of an individual channel / feed with this method, by going to that feed, making a user query from there, and sharing it.

Edit: The (old) RSS (and OPML) links using master authentication token can be seen with a browser extension such as https://addons.mozilla.org/firefox/addon/want-my-rss

[Arturoe1]

You know it would be great if this could be disabled and be able to use the RSS button like always. There are some like me, who use this in a local server for just home users and we don't need all this features.
In fact this is making the software unusable as in a dockerized session you have to edit the php files to add the correct base url and still doesn't work.

Like why would you do this like that....

[Alkarex]

@Arturoe1 Did you give a try to my suggestion(s)? It is not so hard to instruct your Web browser to show the icon. Available by default in some Web browsers (e.g. SeaMonkey):

or with a simple extension such as https://addons.mozilla.org/firefox/addon/want-my-rss for instance for Firefox or Chrome

And of course all works in Docker as well. My guess is that you have more than one problem.

[aab3r]

Hello,
Thanks for your answer. Yes, it makes sense; I can see now that the calls through the API produce links with different passwords (or tokens, not sure).

So, is the "Master authentication token" expected to be gone some time soon? If so, now I have to change the method for about 90 channels that were feeding a website 😅

[Alkarex]

There is no plan to remove the master authentication token anytime soon, but it is already less visible, user queries are clearly recommended, in particular for the scenario of sharing with third-party persons / publicly

[Alkarex]

Feeding a website, if you own the Web site, is a scenario that is acceptable for a Master authentication token

[aab3r]

Yes, that is the case, a website of an org I do technical stuff for; the feeds are not shared publicly.

When you say "but it is already less visible", do you mean that it is still possible to share through master authentication token if I add new channels? I'm looking through all the options, but I can't find it...

[Alkarex]

By less visible, I mean that the icon is gone, but new URLs can still be constructed.
We could even fix the HTML meta link to those RSS feeds so that they would include the token. Those links can be seen with a browser extension such as https://addons.mozilla.org/firefox/addon/want-my-rss

[aab3r]

That's just the extension I use :) And yes, I can see that it provides an RSS, but as you say, without the token.
As this instance of FreshRSS is used by people with little technical skills, I'd really appreciate the fix you say; if you tell me how to implement it, I can do it in the server.
Thanks a lot!

[Alkarex]

Please try #6160

[aab3r]

Yay! It works perfect! Just choosing a channel, get the rss from want-my-rss and it contains the token.

Thanks for the quick response and fix :)

[skvaller]

Can you please add the rss icon again? Atletrantively create an on/off button in admin? I use the program for collection and from there channeling to my website.

[Alkarex]

@skvaller See the response higher up, which contains two solutions to cover your need #6159 (comment)

[skvaller]

Thank you for answering!
I'm not sure how this solves my issue? The freshrss webapp is mine. The feeds are mine collected from multiple locations and I want all to be pulled to another website of mine. Me as owner, as admin of the freshrss shouldn't be limited when logged in. If my users of which I have non on freshrss can't pull to third party, is less of my personal interest. To me freshrss is a tool, a cogwheel but not an endpoint. Taking the rss-easy-fetch-icon away is irritating. Also, if I use freshrss to spread my own articles from the application which I choosed to display publicly, I lose readers? I'm not sure how to solve this?

[Alkarex]

As explained in the answer, the old feature is still available, and you can still get an icon in your browser