https://answers.axonivy.com/questions/2462/is-it-possible-to-access-ivy-s-restful-api-from-an-htmldialog-or-within-the-same-session<p>Hi Ivy Team</p> <p>I have a HtmlDialog containing several links to our RESTful API (implemented using Axon.ivy). However, every time the user accesses to the API, the browser requires authentication even though the user has already logged in.</p> <p>I'm aware of the <code>javax.annotation.security.PermitAll/DenyAll</code> (-- which seems to be the only annotations supported?) but I want to keep the Basic authentication intact.</p> <p>Say the page could be like this:</p> <pre><code>&lt; !-- The HelloWorld dialog --&gt; &lt; h:html&gt; &lt; h:body&gt; &lt; h:outputLink value="/ivy/api/designer/helloworld" target="_blank"&gt; Click to see Hello World &lt; /h:outputLink&gt; &lt; h:outputLink value="/ivy/file/designer/session/some_file_already_created.txt" target="_blank"&gt; Get content of file &lt; /h:outputLink&gt; &lt; h:/body&gt; &lt; /h:html&gt; </code></pre> <p>The first link will require authentication whereas the second works normally.</p> <p>Is there a possible way to overcome this?</p>enThu, 14 Mar 2019 10:29:19 -0400https://answers.axonivy.com/questions/2462/is-it-possible-to-access-ivy-s-restful-api-from-an-htmldialog-or-within-the-same-session/3740<h2><strong>LE Version 7.1+:</strong></h2> <p>Since version 7.1 the Ivy Engine is able to reuse the authenticated session for the REST service call. This was implemented with <a href="https://jira.axonivy.com/jira/browse/XIVY-1183">XIVY-1183</a>.</p> <p>Note that the Engine will check for the CSRF (X-Requested-By) mitigation in the header. See chapter <a href="https://developer.axonivy.com/doc/latest/DesignerGuideHtml/ivy.integration.html#ivy-integration-rest">Engine REST Integration</a> in our documentation.</p> <h2><strong>LTS Version 7.0.11+:</strong></h2> <p>We applied these changes to the LTS version 7.0.11 (story <a href="https://jira.axonivy.com/jira/browse/XIVY-3119">XIVY-3119</a>).</p> <p>Note that by default this feature is switched off and the Engine is also not checking for the CSRF header token. In order to enable the session reuse you need to set the following Java system properties to <code>true</code>:</p> <ul> <li><code>IVY_REST_SERVLET_SESSION_REUSE</code></li> <li><code>IVY_REST_SERVLET_CSRF_PROTECTION</code></li> </ul> <p>For security reasons it is highly recommended to enable the CSRF mitigation when enabling the REST session reuse.</p>Andreas RuschThu, 14 Mar 2019 10:29:19 -0400https://answers.axonivy.com/questions/2462/is-it-possible-to-access-ivy-s-restful-api-from-an-htmldialog-or-within-the-same-session/3740