HttpClient and CSRF token in Alfresco Ent v4.2.1

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

nenad982

Hi all,

in Alfresco Enterprise v4.1.2 we had script that used

org.apache.commons.httpclient.HttpClient
‍‍‍

to call out-of-the-box alfresco's services. When this script is called, first we will authenticate user calling (POST /share/page/dologin) and after that other core services that we need. But from Alfresco Enterprise v4.1.4 CSRF Filter is introduced.

So is there some way to fetch Alfresco-CSRF-Token after user is logged in using HttpClient in Java API, and use that token in all subsequent service calls?

Thanks…

kaynezhang

You can call api

 http://localhost:8080/alfresco/service/api/login ‍

to login and get login ticket.
Then passing ticket as a http request parameter in folloing calls ,like follow

      HttpClient client = new HttpClient();
      String apiurl = "http://localhost:8080/alfresco/service/api/login";
      PostMethod post = new PostMethod(apiurl);
      JSONObject login = new JSONObject();
      login.put("username", "admin");
      login.put("password", "admin");
      post.setDoAuthentication(true);
      post.setRequestHeader("Content-Type", "application/json");
      post.setRequestEntity(new StringRequestEntity(login.toString(),"application/json", "UTF-8"));
      int status = client.executeMethod(post);
      String responseData = post.getResponseBodyAsString();
      JSONObject response = new JSONObject(responseData);
      String ticket = response.getJSONObject("data").getString("ticket"); // get login ticket

      String apiurl = other webscript url "+"?alf_ticket="+ticket; //pass ticket as parameter in following calls
      PostMethod post = new PostMethod(apiurl);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍