rest - Basic auth in Apigility when using Postman -
i have simple rest service using apigility, exposing , post methods. test using postman. works fine.
i try add authentication layer. so, create htpasswd file, create basic auth adapter pointing file via apigility interface , select authentication type on settings page of api.
i choose add authorization request post request, not get.
when try post, i'm asked login , password, type 1 matching htpasswd file content, authorization header generated , post works great.
but when try make request without authorization header, i'm still asked login , password. if cancel, 401 status code (unauthorized).
as far understand, if no authorization header set, "guest" mode used apigility, , method doesn't require authentication, shouldn't have enter login , password access resource.
where did go wrong? didn't understand right?
thanks
you mentioned you're doing in postman, , think therein lies issue.
the http authentication has "pre-auth" stage whereby, if no credentials present, includes www-authenticate
header in response. machine clients (curl, httpie, language-based clients, etc.), ignored long status code not 401 or 403.
however, in browser-based clients, such postman, when browser encounters such header, they'll typically issue authentication challenge, , send empty credentials if cancelled. this, of course, means authorization header sent invalid credentials, leading 401.
try using curl or httpie cli; should see different behavior there.
Comments
Post a Comment