alf_ticket vs ticket

[stevescott]

I opened my web interface and found an XML file, clicked it to open in a new tab.  I then logged out of alfresco copied the URL out into fiddler, and put alf_ticket on the end to see if I could get it while not being logged in (with a valid ticket of course).

So that failed, fiddler showed me a protected result

so I changed alf_ticket to just ticket (with the same ticket#) and I got the xml file back fine

…whats the deal?  is it now "ticket" for everything?

Even more strange is when I try and use jQuery to get that xml file with Ajax
            var xmlurl = $('#xmlFile').attr('value');
           
            $.ajax({
                type: "GET",
                url: xmlurl,
                dataType: "xml",
                success: parseXml
            });

…it comes back protected
Set-Cookie   JSESSIONID=6816088CF7273B77A1E721C48D9031E3; Path=/alfresco
Location   http://alfrescosite/alfresco/faces/jsp/login.jsp

[openpj]

For all the pages under the path /faces/* and Web Scripts with the Web Client authenticator alfresco/wcservice/*, you have to use the ticket parameter.
For all the Web Scripts with a path alfresco/service/ you have to use the alf_ticket parameter and in this case you are using the HTTP Basic Authenticator.

Hope this helps.