PATCH request on a token changes the key value #10146

New Issue

adam · 2025-12-29T21:27:28+01:00

adam commented

2025-12-29 21:27:28 +01:00

Originally created by @dchiquito on GitHub (Aug 27, 2024).

Originally assigned to: @jeremystretch on GitHub.

Deployment Type

Self-hosted

NetBox Version

v4.0.9

Python Version

3.10

Steps to Reproduce

Make an API call like this:

requests.patch(
    "http://localhost:32768/api/users/tokens/42/",
    json={"write_enabled": False, "description": "modified"}, # Note that key is omitted
    headers={"Authorization": "Token 0123456789abcdef0123456789abcdef01234567"},
)

Expected Behavior

Only fields explicitly listed in the PATCH request should be updated.

Observed Behavior

Any PATCH to a token that omits the key field will repopulate the key field with a randomly generated default value.

This is happening because users.api.serializers.tokens.TokenSerializer.to_internal_value is explicitly setting key if it is not set in the request body. I'm not sure why this is necessary, as the Token model is doing essentially the same thing by overriding save.

Originally created by @dchiquito on GitHub (Aug 27, 2024). Originally assigned to: @jeremystretch on GitHub. ### Deployment Type Self-hosted ### NetBox Version v4.0.9 ### Python Version 3.10 ### Steps to Reproduce Make an API call like this: ```python requests.patch( "http://localhost:32768/api/users/tokens/42/", json={"write_enabled": False, "description": "modified"}, # Note that key is omitted headers={"Authorization": "Token 0123456789abcdef0123456789abcdef01234567"}, ) ``` ### Expected Behavior Only fields explicitly listed in the PATCH request should be updated. ### Observed Behavior Any PATCH to a token that omits the `key` field will repopulate the key field with a randomly generated default value. This is happening because `users.api.serializers.tokens.TokenSerializer.to_internal_value` is explicitly setting `key` if it is not set in the request body. I'm not sure why this is necessary, as the `Token` model is doing essentially the same thing by overriding `save`.

adam added the type: bug status: accepted severity: medium labels 2025-12-29 21:27:29 +01:00

adam closed this issue

2025-12-29 21:27:29 +01:00

adam commented

2025-12-29 21:27:29 +01:00

@caineblood commented on GitHub (Aug 27, 2024):

The above comment asking you to download a file is malware to steal your account; do not under any circumstances download or run it. The post needs to be removed. If you have attempted to run it please have your system cleaned and your account secured immediately.

@caineblood commented on GitHub (Aug 27, 2024): The above comment asking you to download a file is malware to steal your account; do not under any circumstances download or run it. The post needs to be removed. If you have attempted to run it please have your system cleaned and your account secured immediately.

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#10146