Issues when configuring blocked API endpoint policy

[vera]

What steps does it take to reproduce the issue?

While configuring blocked API endpoints today, I ran into two issues:

1. The documentation gives example values for dataverse.api.blocked.endpoints that start with api/:

   

   See https://guides.dataverse.org/en/6.8/installation/config.html#dataverse-api-blocked-endpoints

   However, when I set DATAVERSE_API_BLOCKED_ENDPOINTS=api/admin,api/builtin-users the endpoints were still unblocked and freely accessible.

   I had to set DATAVERSE_API_BLOCKED_ENDPOINTS=admin,builtin-users.

   From looking at the code, I guess it makes sense, because it seems to me that the handling of the config values doesn't differ depending on if the config value comes from the old deprecated DB setting or the new JVM setting...

   dataverse/src/main/java/edu/harvard/iq/dataverse/api/filter/ApiBlockingFilter.java

   Lines 91 to 92 in 15f7b0d

   	endpointList = jvmEndpointList
   	.orElse(settingsService.getValueForKey(SettingsServiceBean.Key.BlockedApiEndpoints, ""));

   dataverse/src/main/java/edu/harvard/iq/dataverse/api/filter/ApiBlockingFilter.java

   Line 111 in 15f7b0d

   updateBlockedPoints(endpointList);

   ..and the old setting docs give an example without /api.

   

   So it seems to me that the JVM setting documentation isn't correct...?

2. I received log warnings about my unblock key being weak, but I think it's an error in the code.

   dataverse/src/main/java/edu/harvard/iq/dataverse/api/filter/ApiBlockingFilter.java

   Lines 107 to 109 in 15f7b0d

   	} else if (passwordValidatorService.validate(key).size() == 0) {
   	logger.warning("Weak unblock key detected. Please use a stronger key for better security.");
   	}

   dataverse/src/main/java/edu/harvard/iq/dataverse/validation/PasswordValidatorServiceBean.java

   Line 146 in ba35f99

   * @return A List with error messages. Empty when the password is valid.

   If the length of the list returned by validate is 0, it means there were no errors, so the key is fine and not weak, right?

Which version of Dataverse are you using?

6.8, but I checked and the issues seem to apply to current develop branch as well

Any related open or closed issues to this bug report?

Didn't find any

Are you thinking about creating a pull request for this issue?
Help is always welcome, is this bug something you or your organization plan to fix?

Sure

[cmbz]

2026-03-23: May be documentation-related, but needs investigation. Sized at 3 for investigation. Reporter may create a related pull request.

[poikilotherm]

This is at least related or an extension of this issue:

• Fail deployment when configuration for blocked api endpoints is invalid to avoid security issues #12049

Maybe even a duplicate?

[pdurbin]

Related:

• New non-Docker installations still use deprecated BlockedApi* database settings #11553