Message-ID: <13795474.3740.1485855089024.JavaMail.confluence@ip-10-127-227-164> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_3739_979446878.1485855089024" ------=_Part_3739_979446878.1485855089024 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html REST API Authentication

REST API Authentication

=20
=20
=20
=20

The REST API supports two authentication methods: session, and basic.&nb= sp;

  • Session-based authentication is meant to be used for A= JAX operations. It will let you re-use the visitor's session to execute ope= rations with their permissions.
  • Basic authentication is often used when writing cross-= server procedures, when one remote application executes operations on one/s= everal eZ Platform instances (remote publishing, maintenance, etc).

Session-based is the default authentication method, as this is needed fo= r UI.

Session based a= uthentication

This authentication method requires a Session cookie to be sent with eac= h request.

If this authentication method is used with a web browser, this session c= ookie is automatically available as soon as your visitor logs in. Add it as= a cookie to your REST requests, and the user will be authenticated.

Logging in

It is also possible to create a session for the visitor if they aren't l= ogged in yet. This is done by sending a POST request to = /user/sessions. = Logging out is done using a DELETE request on the same resource.

More information

Session-based authentication = chapter of the REST specifications

HTTP Basic authent= ication

To enable HTTP Basic authentication, you need to edit app/config/<= span>security.yml, and add/uncomment the following block. Not= e that this is enabled by default.

ezplatform.yml
=20 
        ezpublish_rest:
            pattern: ^/api/ezp/v2
            stateless: true
            ezpublish_http_basic:
                realm: eZ Publish REST API
=20

Basic authentication requires the username and password to be sent = (username:password), based 64 encoded, with each request, as expla= ined in RFC 2617.

Most HTTP client libraries as well as REST libraries do support this met= hod one way or another.

Raw HTTP request with basic authentication
=20 
GET / HTTP/1.1
Host: api.example.com
Accept: application/vnd.ez.api.Root+json
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=3D=3D
=20
=20
=20
=20
=20

In this topic:

=20 =20

=20
=20
=20
------=_Part_3739_979446878.1485855089024--