Re: Posting an XML document to a protected API



On Jul 27, 8:17 pm, Maruthy Mentireddi <maruthymuk...@xxxxxxxxx>
wrote:
I am working on the FrontEnd of a website and need to make a RESTful
HTTP POST to a Backend system which checks for the presence of an API
KEY and a SESSSION KEY in the request URL as part of the security model.

Eg: To make a HTTP POST request, the URL should be of the format:
http://#{API_KEY}@#{BACKEND_HOST}:#{BACKEND_PORT}/#{PATH_TO_RESOURCE}?session_key=#{SESSION_KEY}

Now the problem I am facing is how do I specify the API_KEY in the URL
using the following code:

********************************************************************
server_addr = "http://#{API_KEY}@#{BACKEND_HOST_AND_PORT}";
api_path =
"#{BACKEND_HOST_PATH}/users/#{session[:user_id]}/contact_groups.xml?session_key=#{session[:session_key]}"

url = URI.parse(server_addr + api_path)
request =
Net::HTTP::Post.new(url.path+"?session_key=#{session[:session_key]}")

request.body = "<?xml version='1.0'
encoding='UTF-8'><contact_groups>SOME NESTED DATA GOES
HERE</contact_groups>"
response = Net::HTTP.start(url.host, url.port) {|http|
http.request(request)}
********************************************************************

When using the exact same code as above, the Backend responds back with
a HTTP 401 - !ruby/object:Net::HTTPUnauthorized error code.

And if I change the last line to include the API KEY as shown below:

response = Net::HTTP.start(url.user + "@" + url.host, url.port) {|http|
http.request(request)}

Ruby gives a"getaddrinfo: nodename nor servname provided, or not known"
error.

What is the right way to make this post to the Backend. Any response in
this regard will be greatly appreciated.

Thanks,
--
Posted viahttp://www.ruby-forum.com/.

Since there doesn't seem to be alot of ri documentation about
Net::HTTP::Post and I'm too lazy to look at the source,
Net::HTTP.start looks like its invoked like this:

-------------------------------------------------------
Net::HTTP::start
Net::HTTP::start(address, port = nil, p_addr = nil, p_port = nil,
p_user = nil, p_pass = nil) {|+http+| ...}
------------------------------------------------------------------------
creates a new Net::HTTP object and opens its TCP connection and
HTTP session. If the optional block is given, the newly created
Net::HTTP object is passed to it and closed when the block
finishes. In this case, the return value of this method is the
return value of the block. If no block is given, the return value
of this method is the newly created Net::HTTP object itself, and
the caller is responsible for closing it upon completion.


so instead of loading the apikey and port and all into a single
string, have you tried using the parameters to the Net::HTTP.start
method as such?

Eitherway, you might just be better of using curb for anything HTTP
related.
.



Relevant Pages

  • Posting an XML document to a protected API
    ... HTTP POST to a Backend system which checks for the presence of an API ... KEY and a SESSSION KEY in the request URL as part of the security model. ...
    (comp.lang.ruby)
  • Re: [Full-disclosure] Attacking the local LAN via XSS
    ... headers of the request and it is not possible to perform it HTML forms ... I'm guessing you mean HTTP POST:) ... The only time consuming part is gathering router identification traits ... and tailoring login and change requests to specific router vendors. ...
    (Full-Disclosure)
  • RE: Meaning of "Post a Page to a Page"
    ... aspx, it pipes the request to the asp.net runetime. ... send the response back to iis. ... I understand that with the HTTP Post, some data is received by ASP.NET - ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: AJAX POST on Socket
    ... it seems that there is a difference in the speed the request is sent on the socket between the AJAX post and HTTP post. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: [Full-disclosure] Netgear DG632 Router Remote DoS Vulnerability
    ... HTTP POST ... request for this file causes the web server to hang. ... While the router will still continue to function at the network level, ... if the administrator has enabled the "Remote Management" feature on the ...
    (Full-Disclosure)