HttpClient and CSRF token in Alfresco Ent v4.2.1

[nenad982]

Hi all,

in Alfresco Enterprise v4.1.2 we had script that used

org.apache.commons.httpclient.HttpClient
‍‍‍

to call out-of-the-box alfresco's services. When this script is called, first we will authenticate user calling (POST /share/page/dologin) and after that other core services that we need. But from Alfresco Enterprise v4.1.4 CSRF Filter is introduced.

So is there some way to fetch Alfresco-CSRF-Token after user is logged in using HttpClient in Java API, and use that token in all subsequent service calls?

Thanks…

[kaynezhang]

You can call api

 http://localhost:8080/alfresco/service/api/login ‍

to login and get login ticket.
Then passing ticket as a http request parameter in folloing calls ,like follow

      HttpClient client = new HttpClient();
      String apiurl = "http://localhost:8080/alfresco/service/api/login";
      PostMethod post = new PostMethod(apiurl);
      JSONObject login = new JSONObject();
      login.put("username", "admin");
      login.put("password", "admin");
      post.setDoAuthentication(true);
      post.setRequestHeader("Content-Type", "application/json");
      post.setRequestEntity(new StringRequestEntity(login.toString(),"application/json", "UTF-8"));
      int status = client.executeMethod(post);
      String responseData = post.getResponseBodyAsString();
      JSONObject response = new JSONObject(responseData);
      String ticket = response.getJSONObject("data").getString("ticket"); // get login ticket

      String apiurl = other webscript url "+"?alf_ticket="+ticket; //pass ticket as parameter in following calls
      PostMethod post = new PostMethod(apiurl);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[nenad982]

Hi kaynezhang,

thanks a lot for your response. Your answers are very helpful.
I am not sure that Alfresco-CSRF-Token and ticket are the same thing. I saw that in v4.2.1 of Alfresco new Alfresco-CSRF-Token request header is included for all subsequent requests after user login.

So can I use the ticket value as value for Alfresco-CSRF-Token request header?

Thanks

[nenad982]

Did anyone have experience with HttpClient and CSRF token?

Thanks in advance