https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid<p>Hi Ivy Team,</p> <p>Is there a way to get the JSESSIONID (or the whole cookie itself) of the logged in user ?</p> <p>I want to build a rest method which is authenticating the user. I need to return the cookie, so that next requests are authenticated</p> <p>BR, Yordan</p>enWed, 09 Oct 2019 05:05:09 -0400https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4085<p>Hi Yordan</p> <p>I can now reproduce your problem and see your use case!</p> <p>I think we have a bug there because on login we change the session id and we then do not map the correct session. As workaround you could disable RenewIdOnLogin like this in ivy.yaml:</p> <pre><code>Session: RenewIdOnLogin: false </code></pre> <p>With the follwowing code you can get the current http session id:</p> <pre><code>Ivy.request().getSession().getHttpSessionIdentifier(); </code></pre>SupportIvyTeamWed, 09 Oct 2019 05:05:09 -0400https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4085https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4076<p>Hi Reguel,</p> <p>I was able to add Authorization Basic header before ApplicationSessionRequestFilter. In result, the session of the user was changed based on this header.</p> <p>However, the returned cookie form this request, is still not valid for the next calls ... ) the second call is authenticated as Developer)</p> <p>I assume that this is a bug.</p> <p>Here how you can reproduce it:</p> <ol> <li>create project myapp with two REST endpoints (require authentication) (/ivy/api/myapp/loginCall and /ivy/api/myapp/checkCurrentUser); in both of them just log Ivy.session().getSessionUserName()</li> <li>create user -&gt; allan:allan</li> <li>add this code snippet as index2.html and place it in \AxonIvyDesigner7.4.0\webapps\ivy</li> <li>test it on <a href="http://localhost:8081/ivy/index2.html">http://localhost:8081/ivy/index2.html</a> (clean cache/session first)</li> </ol> <p>html:</p> <pre><code>&lt;!DOCTYPE html&gt; &lt;html&gt; &lt;head&gt; &lt;meta charset="UTF-8"&gt; &lt;title&gt;Test&lt;/title&gt; &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"&gt;&lt;/script&gt; &lt;script&gt; function loginCall() { var authToken = btoa('allan:allan'); //user and passowrd return $.ajax({ url: "/ivy/api/myapp/loginCall", type: 'GET', headers:{ 'X-Requested-By': 'myapp', 'Content-Type':'application/json', 'Authorization': 'Basic ' + authToken }, dataType: 'json' }); } function checkProfile() { return $.ajax({ url: "/ivy/api/myapp/checkCurrentUser", type: 'GET', headers:{ 'X-Requested-By': 'myapp', 'Content-Type':'application/json' }, dataType: 'json' }); } $(document).ready(function() { loginCall() .done(function() { checkProfile() .done(function(response) { }).fail(function() { }); }).fail(function() { }); }); &lt;/script&gt; &lt;/head&gt; &lt;body&gt; check F12 &lt;/body&gt; &lt;/html&gt; </code></pre> <p>BR, Yordan</p>Stelt0Mon, 07 Oct 2019 06:25:30 -0400https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4076https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4066<p>If setting up a BASIC_AUTH header on client side is the main issues I think it should be possible to solve this in an additional <code>ContainerRequestFilter</code> for the IVY Rest stack. </p> <p>Currently auth and session handling is done in : <code>ch.ivyteam.ivy.webserver.internal.rest.security.ApplicationSessionRequestFilter</code> <img alt="alt text" src="https://answers.axonivy.com/upfiles/appSessionFilter.png"></p> <p>The request filter comes with a priority (in this case: 1'000). Therefore, it should be possible to provide an additional request filter that can change the request just before the default filter is executed. Your custom filter could compensate the inabilities of the real client &gt; transform form params into http_basic auth headers.</p> <p>To setup your custom filter as general extension for the ivyEngine REST stack you have to add the <code>@Provider</code> annotation on the class body. See <a href="https://answers.axonivy.com/questions/3412/how-can-i-use-jax-rs-containerrequestfilter-responsefilter-for-my-jax-rs-resources">https://answers.axonivy.com/questions/3412/how-can-i-use-jax-rs-containerrequestfilter-responsefilter-for-my-jax-rs-resources</a></p> <p>...just an idea: I did not check it with an example. </p> <p>PS: be aware that big improvements from 7.4 REST stack have been ported back to the 7.0 LTS train recently. So ensure that you work with the latest hotfix version to benefit of the extension capabilities mentioned here.</p>Reguel WermelingerFri, 04 Oct 2019 02:11:02 -0400https://answers.axonivy.com/questions/4032/rest-api-and-jsessionid/4066