Moqui REST API call fail with error code 403

Question

From my Angular 2 application I am trying to get data from Moqui but the request always fails with the error code 403.

Here is the REST API call implementation

        getExample() {
        let url = 'http://localhost:8080/rest/s1/example/examples'
        let headers = new Headers({ 'Authorization': 'Basic 
        am9obi5kb2U6bW9xdWk='});
        headers.append('Accept', 'application/json, text/plain, */*');
        headers.append('Content-Type', 'application/json; charset=UTF-8');
        let options = new RequestOptions({ headers: headers });
        let response = this.http.get(url, options).map(res => res.json());
        return response;
      }

The Moqui logs :-

REST Access Forbidden (no authz): User null is not authorized for View on REST Path /example/examples

There is also a similar question Moqui Rest Nginx but from the answer I do not know that where I have to change the settings in Moqui.

On the client console the error is :-

XMLHttpRequest cannot load http://localhost:8080/rest/s1/example/examples. Response for preflight has invalid HTTP status code 403

But with a rest client like YARC it works :-

Answer 1

You must authenticate for REST API calls except for Service REST API paths that are configured to not require authentication (like the /mantle/my end points in the mantle.rest.xml file in the mantle-usl component).

You have authentication but then there is one other step: authorization. In general if authc is required then authorization is also required. This is done with database records usually either in seed data and can also be added using the System app that is included in the default Moqui runtime (ie the moqui/moqui-runtime repository).

There is an example of authorization setup for Service REST API calls in the MantleSetupData.xml file. The main difference from screen authorization is that the artifact type to use is 'AT_REST_PATH'. Here is that file on GitHub (right near the top of the file):

https://github.com/moqui/mantle-usl/blob/master/data/MantleSetupData.xml

The best documentation for most things to do with REST requests in Moqui, is currently in the comments in the 'rest.xml' file that actually processes the incoming requests (ie handles the /rest path). You can see this on GitHub here:

https://github.com/moqui/moqui-runtime/blob/master/base-component/webroot/screen/webroot/rest.xml