eZ Documentation Center

This is outdated documentation made for eZ Publish Platform 5.1. It is being moved into the eZ Publish 5.x documentation, so please go there for most up-to-date documentation.

Skip to end of metadata
Go to start of metadata

At the time of the 5.0 release, two authentication methods were supported: session, and basic. Session based authentication is meant to be used for AJAX operations. It will let you re-use the visitor's session to execute operations with their permissions. Basic authentication will be useful when writing cross-server procedures, when one server executes operations on one/several eZ Publish instances (remote publishing, maintenance, etc).


5.0Session and Basic support


Session based

This authentication method requires a Session cookie to be sent with the request. If this authentication method is used through a web browser, this session cookie is available as soon as your visitor logs in. Add it as a request cookie to your REST requests, and the user will be authenticated.

Setting it up

To enable session based authentication, you need to edit ezpublish/config/security.yml, and comment / remove the configuration block about REST


Logging in

It is also possible to create a session for the visitor if he isn't logged in yet. This is done by sending a POST request to /user/sessions. Logging out is done using a DELETE request on the same resource.

More details about this can be found in the reference documentation.


Session authentication with siteaccess header

is_logged_in cookie

Session auth currently requires the is_logged_in cookie to be provided with every authenticated request. This cookie will be sent in reply to a successful session authentication.

Session authentication with siteaccess header

Basic HTTP authentication

Basic authentication requires the password to be sent, based 64 encoded, with the request, as explained in RFC 2617.

Most HTTP client libraries as well as REST libraries, should support this method one way or another.

Raw HTTP request with basic authentication
  • No labels