topic Re: HttpClient and CSRF token in Alfresco Ent v4.2.1 in Alfresco Archive

HttpClient and CSRF token in Alfresco Ent v4.2.1

nenad982 — Fri, 25 Apr 2014 16:56:58 GMT

Hi all,in Alfresco Enterprise v4.1.2 we had script that usedorg.apache.commons.httpclient.HttpClient‍‍‍to call out-of-the-box alfresco's services. When this script is called, first we will authenticate user calling (POST /share/page/dologin) and after that other core services that we need. But from

Re: HttpClient and CSRF token in Alfresco Ent v4.2.1

kaynezhang — Sat, 26 Apr 2014 01:00:22 GMT

You can call api

 http://localhost:8080/alfresco/service/api/login ‍

to login and get login ticket.
Then passing ticket as a http request parameter in folloing calls ,like follow


      HttpClient client = new HttpClient();
      String apiurl = "http://localhost:8080/alfresco/service/api/login";
      PostMethod post = new PostMethod(apiurl);
      JSONObject login = new JSONObject();
      login.put("username", "admin");
      login.put("password", "admin");
      post.setDoAuthentication(true);
      post.setRequestHeader("Content-Type", "application/json");
      post.setRequestEntity(new StringRequestEntity(login.toString(),"application/json", "UTF-8"));
      int status = client.executeMethod(post);
      String responseData = post.getResponseBodyAsString();
      JSONObject response = new JSONObject(responseData);
      String ticket = response.getJSONObject("data").getString("ticket"); // get login ticket

      String apiurl = other webscript url "+"?alf_ticket="+ticket; //pass ticket as parameter in following calls
      PostMethod post = new PostMethod(apiurl);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: HttpClient and CSRF token in Alfresco Ent v4.2.1

nenad982 — Sat, 26 Apr 2014 12:08:39 GMT

Hi kaynezhang,

thanks a lot for your response. Your answers are very helpful.
I am not sure that Alfresco-CSRF-Token and ticket are the same thing. I saw that in v4.2.1 of Alfresco new Alfresco-CSRF-Token request header is included for all subsequent requests after user login.

So can I use the ticket value as value for Alfresco-CSRF-Token request header?

Thanks

Re: HttpClient and CSRF token in Alfresco Ent v4.2.1

nenad982 — Wed, 07 May 2014 07:50:16 GMT

Did anyone have experience with HttpClient and CSRF token?

Thanks in advance