rest api

[Drew Pierce]

I'm trying to use the rest api and in the documentation it says that we can do a curl call but it doesn't look like Tomcat likes the curl request.  Any help or pointers in debugging would help.

-Drew

When running the following I'm getting a 400 error.

curl -v -H "X-WPS-Username: username" -H 'X-WPS-Password: password' http://host:8080/wps/rest/passwords?query=test

< HTTP/1.1 400 Bad Request

< Server: Apache-Coyote/1.1

< Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:; frame-src 'self'; style-src 'self' 'unsafe-inline'

< X-WebKit-CSP: default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:; frame-src 'self'; style-src 'self' 'unsafe-inline'

< X-Content-Security-Policy: default-src 'self' data:; img-src 'self' data:; options inline-script eval-script

< Content-Type: text/html;charset=utf-8

< Content-Language: en

< Content-Length: 968

< Date: Wed, 09 Mar 2016 23:11:39 GMT

< Connection: close

< 

* Closing connection 0

HTTP Status 400 -

---

type Status report

message

description The request sent by the client was syntactically incorrect.

---

Apache Tomcat/7.0.47

[Gordon Tetlow]

The default implementation for the REST API requires the TOTP header as well, even if it isn't used:

curl -v -H "X-WPS-Username: username" -H 'X-WPS-Password: password' -D 'X-WPS-TOTP: 123456' http://host:8080/wps/rest/passwords?query=test

I've got a fix in github for it if you are interested:

https://github.com/tetlowgm/webpasswordsafe/commit/14bc5976b67514fddd532a2ab1cd8596e0e833b9

Regards,

Gordon

--
You received this message because you are subscribed to the Google Groups "webpasswordsafe" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webpasswordsa...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Drew Pierce]

Thanks Gordon,

I was able to turn on debug and was seeing 'X-WPS-TOTP' missing but didn't know what that was until I saw 1.3 release notes the figured out the "two step Verification" and figured deduced it was a kind of like a token that needed to be passed.

-Drew

[Gordon Tetlow]

To be clear, if you aren't using the TOTP plugin, you can just pass any bogus value.

Gordon