Accessing secured rest api at server side generated by hyperledger composer rest server

Question

I am generating rest apis using composer-rest-server. I am authenticating rest api using passport-jwt. In composer rest server we get access_token in cookie.

We can set withCredentials:true for accessing these apis using client side but how can we call these apis using server side

Now when we make the same api call initiated from the server side(java), it fails. Giving us 401: Authorization Required error.

So my question is - Is it possible to call secured composer APIs from server side(java) ? If anyone has tried this before please let me know.

the error you're getting is the same as client side ;you are not authenticating correctly. Whether client or server side, you are will send the JWT token in Authorization Header as a Bearer Token. That Passport JWT Strategy (which is not part of Composer, pls note) supports many other ways of getting the token from requests. Choose whichever suits your needs. This blog may also help (its client side) - https://www.codementor.io/gangachris125/passport-jwt-authentication-for-hyperledger-composer-rest-server-jqfgkoljn — Paul O'Mahony, Jul 04 '18 at 09:27
I am authenticating correctly. But we need to pass access_token to access rest end points. When we set withCredentials:true from client side (as done in https://medium.com/@CazChurchUk/developing-multi-user-application-using-the-hyperledger-composer-rest-server-b3b88e857ccc), token is automatically passed to rest api but there is no such option and also we can't get cookie as httpOnly is set false. I can only get connect.sid cookie. I have also referred https://github.com/hyperledger/composer/issues/1996. But I didn't get the solution. — Honey Shah, Jul 04 '18 at 09:37
there are a couple of server side examples (in the answers) described here -> https://stackoverflow.com/questions/41996167/how-to-provide-frontend-with-json-web-token-after-server-authentication (storing the token in the header) — Paul O'Mahony, Jul 04 '18 at 09:59
Thanks for the link but I can't get access_token from my server side application. For setting it in header anyhow I need to fetch access_token that I can't. I have jwt token there but not access_token which sets in cookie by hitting callback url. — Honey Shah, Jul 04 '18 at 10:47
Hi @HoneyShah, were you able to get through this situation? Actually, I'm trying to do exactly the same thing. — Mrudav Shukla, Aug 11 '18 at 09:44
Hello @MrudavShukla Yes, I was able to solve the problem. If you are using java then I can help you for this. — Honey Shah, Aug 13 '18 at 03:46
Hi @HoneyShah, Thanks for responding. I've sent you a connection request on LinkedIn. Or let me know how can I reach out to you. — Mrudav Shukla, Aug 13 '18 at 04:14
@HoneyShah good that you were able to solve the problem . i am facing the same issue . could u tell me what you did to resolve it . a code snippet ?? my question - https://stackoverflow.com/questions/51946208/not-able-to-do-a-post-request-to-an-authenticated-hyperledger-composer-rest-serv — Skadoosh, Aug 21 '18 at 10:07

score 0 · Answer 1 · answered Nov 26 '18 at 09:33

Try this code to retrieve cookies:

public void getCookieUsingCookieHandler() { 
try {       
    // Instantiate CookieManager;
    // make sure to set CookiePolicy
    CookieManager manager = new CookieManager();
    manager.setCookiePolicy(CookiePolicy.ACCEPT_ALL);
    CookieHandler.setDefault(manager);

    // get content from URLConnection;
    // cookies are set by web site
    URL url = new URL("http://host.example.com");
    URLConnection connection = url.openConnection();
    connection.getContent();

    // get cookies from underlying
    // CookieStore
    CookieStore cookieJar =  manager.getCookieStore();
    List <HttpCookie> cookies =
        cookieJar.getCookies();
    for (HttpCookie cookie : cookies) {
            if (cookie.getName().equalsIgnoreCase("access_token")) {
                System.out.println("CookieHandler retrieved cookie: " + cookie.getValue());
                break;
            }

        }
} catch(Exception e) {
    System.out.println("Unable to get cookie using CookieHandler");
    e.printStackTrace();
}
}

One can refer it from here: https://docs.oracle.com/javase/tutorial/deployment/doingMoreWithRIA/accessingCookies.html

Accessing secured rest api at server side generated by hyperledger composer rest server

1 Answers1