Cocoa: POST headers/parameters lost when accessing protected resources in a Django site using NSURLConnection

Question

I am trying to access protected resources on a Django site using NSURLConnection , OAuth2 Bearer token and HTTPS. I receive a token, which I then attach either to a GET parameter, POST parameter or header. I can access those URL:s which respond to GET parameter. But when I try to access urls using POST, the server returns me a 403 with a custom error message saying there is no header/post parameter containing the token. I have tried several solutions and HTTP libraries. This method uses AFNetworking, I tried it. We even changed the authorization to accept an alternative header due to warnings that apple does not like the modifying of "Authorization" header. My current code looks like this: (scheme == @"https")

    -(void) logOut {

    NSString *pget = @"/api/logout/";
    NSString *path = [pget stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding];

    NSString *absolutePath = [NSString stringWithFormat:@"%@://%@%@", scheme, host, path];

    NSURL *url = [NSURL URLWithString:absolutePath];
    NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:url cachePolicy:NSURLRequestReloadIgnoringLocalCacheData timeoutInterval:30.0];
    NSString *authValue = [NSString stringWithFormat:@"Bearer %@", accessToken];
    [urlRequest setValue:authValue forHTTPHeaderField:@"Authorization_Extra"];
    [urlRequest setValue:@"application/x-www-form-urlencoded; charset=utf-8" forHTTPHeaderField:@"content-type"];
    [urlRequest setHTTPMethod: @"POST"];
    /*
     NSString *post = [NSString stringWithFormat:@"access_token_extra=%@", accessToken];
     NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding];
     NSString *postLength = [NSString stringWithFormat:@"%lu", (unsigned long)[postData length]];
     [urlRequest setValue:postLength forHTTPHeaderField:@"Content-Length"];
     [urlRequest setHTTPBody:postData];
     */
    NSDictionary* headers = [urlRequest allHTTPHeaderFields];
    NSLog(@"headers: %@",headers);
    _originalRequest = urlRequest;
    NSURLConnection* connection = [[NSURLConnection alloc] initWithRequest:urlRequest delegate:self startImmediately:NO];
    [connection start];
}

#pragma mark NSURLConnection Delegate Methods

- (NSURLRequest *)connection: (NSURLConnection *)connection
             willSendRequest: (NSURLRequest *)request
            redirectResponse: (NSURLResponse *)redirectResponse;
{
    if (redirectResponse) {
        // we don't use the new request built for us, except for the URL
        NSURL *newURL = [request URL];
        NSMutableURLRequest *newRequest = [_originalRequest mutableCopy];
        [newRequest setURL: newURL];

        NSLog(@"New Request headers: %@", [newRequest allHTTPHeaderFields]);
        return newRequest;
    } else {
        return request;
    }
}

- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSHTTPURLResponse *)response {
    NSLog(@"Received response statuscode: %ld", (long)[response statusCode]);
    responseData = [[NSMutableData alloc] init];
}

- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data {
    [responseData appendData:data];
}

- (NSCachedURLResponse *)connection:(NSURLConnection *)connection
                  willCacheResponse:(NSCachedURLResponse*)cachedResponse {
    return nil;
}

- (void)connectionDidFinishLoading:(NSURLConnection *)connection {
    NSLog(@"connection finished:");
    [_delegate handleData:responseData];
}

The _Delegate handleData parses the response, and the custom response is always that I am lacking either the header or post parameter needed for the Bearer token. It seems that even though I am replacing the request with a mutable copy of the original on every redirect, the headers/parameters still get stripped by NSURLConnection. But why, and how, since I'm sending a copy of the original request every time and I verify by logging that they are there?

Have you tried using a http requester to manually produce your request and see if it works? try https://www.hurl.it/ and see if you can get a valid response. I'm not 100% if you will be able to do this successfully because of your bearer token, but it's just a suggestion that may help eliminate some possibilities — A O, Jan 20 '15 at 20:45
Update: I managed to make the POST parameters get through by fumbling with the code (the commented out part), the encoding changed to UTF8. But I still keep losing the headers. Although I am now able to continue, I am still wondering why NSURLConnection keeps culling the headers. I will try your method and report on the findings if I find out something. — MarekB, Jan 21 '15 at 08:10

Cocoa: POST headers/parameters lost when accessing protected resources in a Django site using NSURLConnection

0 Answers0