# Add rules to saveUser for a token

**URL:** <https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352>\
**Category:** Support\
**Created:** [October 22, 2018, 5:09pm UTC](https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352 "2018-10-22T17:09:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yusufiga](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/yusufiga/32/134_2.png) [@yusufiga](https://discourse.getcockpit.com/u/yusufiga)\
**Post date:** [October 22, 2018, 5:09pm UTC](https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352/1 "2018-10-22T17:09:59Z")

</div>

Hi,

I created a token and added rule `/api/cockpit/saveUser` so it only works for registration. But the problem is if someone just finds the token, it’s possible to create admin by just defining group as admin then that user will have admin rights.

How can I prevent user registration with admin group for a token?

```auto
fetch('/api/cockpit/saveUser?token=xxtokenxx', {
    method: 'post',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        "user": {
            "user": "Test",
            "name": "TestName",
            "password": "123123",
            "email": "test4@invalid.com",    
	    "group": "admin",
	    "active": true
	}
    })
})

```

Thanks

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [October 22, 2018, 9:39pm UTC](https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352/2 "2018-10-22T21:39:11Z")

</div>

> [@yusufiga](#):
>
> { “user”: { “user”: “Test”, “name”: “TestName”, “password”: “123123”, “email”: “[test4@invalid.com](mailto:test4@invalid.com)”, “group”: “admin”, “active”: true } }

If you are planning to store end users as cockpit users may be better to change the strategy, I would prefer to have a collection for it or use a third party system.

In such case, you can protect by hooking into the cockpit.accounts.save and remove the admin groups, e.g.:

```
$app->on('cockpit.accounts.save', function (&$data, $update) {
  // Any additional logic you may require (check if request is from the api, etc..)
  if (in_array($data['group'], ['admin', 'other admin groups'])) {
    unset($data['group']);
  }
});

```

---

<div class="post-metadata">

**Author:** ![yusufiga](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/yusufiga/32/134_2.png) [@yusufiga](https://discourse.getcockpit.com/u/yusufiga)\
**Post date:** [October 22, 2018, 11:42pm UTC](https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352/3 "2018-10-22T23:42:37Z")

</div>

Thanks for the reply I also thought about creating a collection for that but then I have to take care of all the authentication and api\_key stuff which I don’t want.

This hooking should solve my problem but where should I place this code snippet for `cockpit.accounts.save`?

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [October 23, 2018, 8:14am UTC](https://discourse.getcockpit.com/t/add-rules-to-saveuser-for-a-token/352/4 "2018-10-23T08:14:05Z")

</div>

I still think that collections would be more flexible as you can extend the user fields as you need (e.g. multiple roles, address, etc…), the intent of cockpit users is just to manage the CMS.

You can put inside a bootstrap.php file in an addon (e.g. /addons/users/bootstrap.php), a more complete example can be:

```
<?php
if (COCKPIT_API_REQUEST) {
  $app->on('cockpit.accounts.save', function (&$data, $update) {
    // Any additional logic you may require (check if request is from the api, etc..)
    if (in_array($data['group'], ['admin', 'other admin groups'])) {
      unset($data['group']);
    }
  });
}
```