REST API and JSESSIONID

Question

Hi Ivy Team,

Is there a way to get the JSESSIONID (or the whole cookie itself) of the logged in user ?

I want to build a rest method which is authenticating the user. I need to return the cookie, so that next requests are authenticated

BR, Yordan

Answer 1

0

Hi Yordan

I can now reproduce your problem and see your use case!

I think we have a bug there because on login we change the session id and we then do not map the correct session. As workaround you could disable RenewIdOnLogin like this in ivy.yaml:

Session:
  RenewIdOnLogin: false

With the follwowing code you can get the current http session id:

Ivy.request().getSession().getHttpSessionIdentifier();

link

answered 09.10.2019 at 05:05

SupportIvyTeam ♦♦
1.4k●102●118●122
accept rate: 77%

edited 09.10.2019 at 05:31

Hi,

Can I test this on the Designer ? Is it equivalent if I configure it in app-designer.yaml ?

if I set log the getHttpSessionIdentifier and getSessionUserName in the two requests I get again the same behavior

Ivy.log().info(Ivy.request().getSession().getHttpSessionIdentifier()); Ivy.log().info(Ivy.session().getSessionUserName());

alt text

BR, Yordan

(09.10.2019 at 09:19) Stelt0

Do it directly in ivy.yaml in the configuration folder, yes this should also work in designer.

(11.10.2019 at 05:32) SupportIvyTeam ♦♦

Answer 2

Hi Reguel,

I was able to add Authorization Basic header before ApplicationSessionRequestFilter. In result, the session of the user was changed based on this header.

However, the returned cookie form this request, is still not valid for the next calls ... ) the second call is authenticated as Developer)

I assume that this is a bug.

Here how you can reproduce it:

create project myapp with two REST endpoints (require authentication) (/ivy/api/myapp/loginCall and /ivy/api/myapp/checkCurrentUser); in both of them just log Ivy.session().getSessionUserName()
create user -> allan:allan
add this code snippet as index2.html and place it in \AxonIvyDesigner7.4.0\webapps\ivy
test it on http://localhost:8081/ivy/index2.html (clean cache/session first)

html:

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Test</title>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script>

    function loginCall() {
    var authToken = btoa('allan:allan'); //user and passowrd

    return $.ajax({
      url: "/ivy/api/myapp/loginCall",
      type: 'GET',
      headers:{
            'X-Requested-By': 'myapp',
            'Content-Type':'application/json',
            'Authorization': 'Basic ' + authToken
        },
      dataType: 'json'
    });
  }

  function checkProfile() {

    return $.ajax({
      url: "/ivy/api/myapp/checkCurrentUser",
      type: 'GET',
      headers:{
            'X-Requested-By': 'myapp',
            'Content-Type':'application/json'
        },
      dataType: 'json'
    });
  }

  $(document).ready(function() {

      loginCall()
      .done(function() {
        checkProfile()
          .done(function(response) {

          }).fail(function() {

          });
      }).fail(function() {

      });


  });

</script>
</head>

<body>
check F12
</body>

</html>

BR, Yordan

Answer 3

If setting up a BASIC_AUTH header on client side is the main issues I think it should be possible to solve this in an additional ContainerRequestFilter for the IVY Rest stack.

Currently auth and session handling is done in : ch.ivyteam.ivy.webserver.internal.rest.security.ApplicationSessionRequestFilter alt text

The request filter comes with a priority (in this case: 1'000). Therefore, it should be possible to provide an additional request filter that can change the request just before the default filter is executed. Your custom filter could compensate the inabilities of the real client > transform form params into http_basic auth headers.

To setup your custom filter as general extension for the ivyEngine REST stack you have to add the @Provider annotation on the class body. See https://answers.axonivy.com/questions/3412/how-can-i-use-jax-rs-containerrequestfilter-responsefilter-for-my-jax-rs-resources

...just an idea: I did not check it with an example.

PS: be aware that big improvements from 7.4 REST stack have been ported back to the 7.0 LTS train recently. So ensure that you work with the latest hotfix version to benefit of the extension capabilities mentioned here.

REST API and JSESSIONID

Follow this question

Related questions