Issue with Anonymous access and 'Authorization' header on HCL Domino 12
There is a database which has anonymous access "Editor". Anonymous users can access one of the XPages REST API with "Authorization" header. This will have JWT token in the request header as mentioned below.
I read this Token on the server side and process. Recently we have upgraded our servers to Domino 12.0.1 from Domino 10 version. This API is not working and giving the login screen when we have "Authorization" Header. The anonymous access is not working for this page. If we remove the "Authorization" header from request, then anonymous access works.
I have checked the Domino configuration and not able to figure out why login screen coming. Some setting is checking the "Authorization" header and asking for login even though the anonymous access is "Editor".
I want to access this REST Api without login screen and should accept the "Authorization".
Domino 12 has native support for JTW authentication using an OIDC provider.
This means that the Authorization header is natively handled by the Domino 12 HTTP stack so that you (unfortunately) can not access the Authorization header in your custom code.
I suggest that you vote for this idea: https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2405.
- slack custom workflow step response
- Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Handler dispatch failed;
- Why would HTTP content negotiation be preferred to explicit parameters in an API scenario?
- HTTP Status 405 - Method Not Allowed Error for Rest API
- Binance REST API - Placing a PHP Order (POST) via Query String
- Which HTTP response code for "This email is already registered"?
- GET request not supported in custom API in Business Central. "BadRequest_MethodNotAllowed"
- Place API key in Headers or URL
- Access Microsoft Todo List via Rest API
- Groovy POST request with form filling in it
- 415 unsupported media type angular spring boot POST PUT http methods
- What HTTP methods should be chosen in a REST API when no CRUD operations are going to be performed?
- How I return HTTP 404 JSON/XML response in JAX-RS (Jersey) on Tomcat?
- How to properly implement login and token handling from REST endpoint in ASP.NET Core/MAUI Blazor
- TypeError - ctx.request.body is not a function
- How to call another api from same app in spring boot
- 403 Forbidden when introducing authorization on spring boot rest
- Generating REST documentation in a Codeigniter project
- How to access request body when using Django Rest Framework and avoid getting RawPostDataException
- Structuring linked backend queries and storage
- Google Drive REST in iOS
- Http Delete request to django returns a 301(Moved permenantly)
- How do I use StreamedRequest in Dart http library to upload a file?
- Deleting a Pinterest pin via Pinterest API in Objective-C
- How to easy implement 'REST API query language' with Querydsl and Spring Data to filter the entities?
- How to Get All Endpoints List After Startup, Spring Boot
- Protocol Buffer vs Json - when to choose one over the other?
- User authentication in mobile
- CORS - localhost as allowed origin in production
- My rest services relies on an external service. How do I mock it to use on my cucumber tests?