At the time of the 5.0 release, two authentication methods were supported: session, and basic. Session based authentication is meant to be used for AJAX operations. It will let you re-use the visitor's session to execute operations with their permissions. Basic authentication will be useful when writing cross-server procedures, when one server executes operations on one/several eZ Publish instances (remote publishing, maintenance, etc).
|5.0||Session and Basic support|
This authentication method requires a Session cookie to be sent with the request. If this authentication method is used through a web browser, this session cookie is available as soon as your visitor logs in. Add it as a request cookie to your REST requests, and the user will be authenticated.
To enable session based authentication, you need to edit
ezpublish/config/security.yml, and comment / remove the configuration block about REST
ezpublish_rest: pattern: ^/api/ezp/v2 stateless: true ezpublish_http_basic: realm: eZ Publish REST API
It is also possible to create a session for the visitor if he isn't logged in yet. This is done by sending a
POST request to
/user/sessions. Logging out is done using a
DELETE request on the same resource.
More details about this can be found in the reference documentation.
GET /api/ezp/v2/user/roles HTTP/1.1 Host: api.example.com Accept: application/vnd.ez.api.RoleList+json Cookie: eZSESSID22af645d1859cb5ca6da0c484f1f37ea=ca8123ccb543834fecd48f282a40156e
Session auth currently requires the
Basic authentication requires the password to be sent, based 64 encoded, with the request, as explained in RFC 2617.
Most HTTP client libraries as well as REST libraries, should support this method one way or another.
GET / HTTP/1.1 Host: api.example.com Accept: application/vnd.ez.api.Root+json Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==