Authentication issues with appKey in HTTP session, alternating

[dwightwhe]

Hi,

not sure if this is a known issue or even an issue at all, but I observe the following behavior when working in a HTTP session when using an appKey only, e.g. when accessing the REST API and not logging in.

E.g. open a Chrome incognito window. Paste in a URL with an appKey

http://192.168.56.10/Thingworx/Things?appKey=6df76965-0763-4229-8126-5bc3a7978907

The first time this call returns the desired result. The second time (hit Ctrl-R or refresh), I get an error page:

"HTTP Status 401 - No authType or appKey parameter has been specified for Authentication Scheme: AUTH_THINGWORX_APPKEY"

Another Ctrl-R refresh brings back the normal call result and the next one again the error. It alternates.

The same alternating errors occur from within my http client library that I use to access the REST API when I use sessions. This basically requires that I cannot use the session capability and must create a new request every single call. Also happens in a normal browser window when not doing password authentication.

After password authentication with ThingWorks, it works fine in normal browser windows.

Is this intended or an issue?

Thanks!

[VladimirRosu]

Hi Dwight,
Do you also use the x-thingworx-session=true in the url?
I had this behaviour when not using this url parameter set to true.

BR,
Vladimir

[dwightwhe]

Thanks Vladimir,

this solves it.

Best

[qn]

Hi,

With the option "x-thingworx-session=true", a session will be created. Does it mean that the user has to logout before wanting to login with another user ?

Regards,

[mhollenbach]

If the user does not logout, their session will remain active until the Tomcat session timeout property has been met. The default value is 30 minutes, but the User will be able to create as many active sessions as they want. You can test this by opening your browser in Incognito Mode.

Meghan