At the time of the 5.0 release, two authentication methods were supported: session, and basic. Session based authentication is meant to be used for AJAX operations. It will let you re-use the visitor's session to execute operations with their permissions. Basic authentication will be useful when writing cross-server procedures, when one server executes operations on one/several eZ Publish instances (remote publishing, maintenance, etc).
Changelog
| Version | |
|---|
| 5.0 | Session and Basic support |
Session based
This authentication method requires a Session cookie to be sent with the request. If this authentication method is used through a web browser, this session cookie is available as soon as your visitor logs in. Add it as a request cookie to your REST requests, and the user will be authenticated.
Setting it up
To enable session based authentication, you need to edit ezpublish/config/security.yml, and comment / remove the configuration block about REST
| Code Block |
|---|
| language | none |
|---|
| title | ezpublish.yml |
|---|
|
ezpublish_rest:
pattern: ^/api/ezp/v2
stateless: true
ezpublish_http_basic:
realm: eZ Publish REST API |
Logging in
It is also possible to create a session for the visitor if he isn't logged in yet. This is done by sending a POST request to /user/sessions. Logging out is done using a DELETE request on the same resource.
More details about this can be found in the reference documentation.
Example
| Code Block |
|---|
| title | Session authentication with siteaccess header |
|---|
|
GET /api/ezp/v2/user/roles HTTP/1.1
Host: api.example.com
Accept: application/vnd.ez.api.RoleList+json
Cookie: eZSESSID22af645d1859cb5ca6da0c484f1f37ea=ca8123ccb543834fecd48f282a40156e |
| Info |
|---|
|
Session auth currently requires the is_logged_in cookie to be provided with every authenticated request. This cookie will be sent in reply to a successful session authentication. | Code Block |
|---|
| title | Session authentication with siteaccess header |
|---|
| GET /api/ezp/v2/user/roles HTTP/1.1
Host: api.example.com
Accept: application/vnd.ez.api.RoleList+json
Cookie: eZSESSID22af645d1859cb5ca6da0c484f1f37ea=ca8123ccb543834fecd48f282a40156e; is_logged_in=true |
|
Basic HTTP authentication
Basic authentication requires the password to be sent, based 64 encoded, with the request, as explained in RFC 2617.
Most HTTP client libraries as well as REST libraries, should support this method one way or another.
| Code Block |
|---|
| language | none |
|---|
| title | Raw HTTP request with basic authentication |
|---|
|
GET / HTTP/1.1
Host: api.example.com
Accept: application/vnd.ez.api.Root+json
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== |