Skip to main content
ptc-8921310-Marble
10-Marble
July 26, 2015
Solved

Why is CreateThing java REST call in R6 is failing with HTTP Error 403 Forbidden?

  • July 26, 2015
  • 12 replies
  • 5486 views

The method=post is not allowed in URL parameter in TWX server R6 version due to security issues. So modified the code to use post like below. However the request still fails. I have ensured that URL as well as appKey is correct. Any Ideas ?

URL thingworx_rest_url = new URL(

  ACConfig.REST_BASEURI + "Resources/EntityServices/Services/CreateThing");

  HttpURLConnection http_connection = (HttpURLConnection) thingworx_rest_url

  .openConnection();

  http_connection.setDoOutput(true);

  http_connection.setRequestMethod("POST");

  http_connection.setRequestProperty("appKey", ACConfig.AUTH_APPKEY);

  http_connection.setUseCaches(false);

  String input = "name="

  + ACConfig.ACThingName + "&description="

  + ACConfig.ACThingName

  + "&thingTemplateName=RemoteThing";

  byte[] postData       = input.getBytes( StandardCharsets.UTF_8 );

  int postDataLength = postData.length;

  http_connection.setInstanceFollowRedirects( false );

  http_connection.setRequestMethod( "POST" );

  http_connection.setRequestProperty( "Content-Type", "application/x-www-form-urlencoded");

  http_connection.setRequestProperty( "charset", "utf-8");

  http_connection.setRequestProperty( "Content-Length", Integer.toString( postDataLength ));

  try( DataOutputStream wr = new DataOutputStream( http_connection.getOutputStream())) {

    wr.write( postData );

  }

  if (http_connection.getResponseCode() != HttpURLConnection.HTTP_CREATED) {

  throw new RuntimeException("Failed : HTTP error code : "

  + http_connection.getResponseCode());

  }

Best answer by ptc-89213

Resolved by using json content in post instead of plain text.

If you need to use plain text, then filter content option should be turned off.

12 replies

paic1-Visitor
1-Visitor
July 27, 2015

If the call is properly formed (sorry I can't ensure that from just looking at your script) try executing it twice in a row.

If that works, I believe there is a knowledge base article about this type of behavior.

ptc-8921310-MarbleAuthor
10-Marble
July 27, 2015

Hi,

As this is a programatic call, it cannot be executed twice..

I resolved it however by enabling REST on 6.0 as follows..

To unlock/ allow all REST calls, here are the steps:

  1. Click on Subsystems under SYSTEM within the left pane of Composer
  2. Click on PlatformSubsystem
  3. Click on Configuration
  4. Check the box next to Allow Request Method Switch to allow all REST API calls through a browser URL
  5. Uncheck Filter Content-Type

Let me know if there is any other preferable way..without compromising on security.

Thanks

Shashikant

paic1-Visitor
1-Visitor
July 27, 2015

Unfortunately if that is what you had to do, then the call you are making is incorrect. That seems to indicate that it is still taking the POST as a URL based call vs. an actual POST

We do not recommend using this switch as it carries security risks with it (Please see release notes on this)

davidcor1-Visitor
1-Visitor
July 29, 2015

I finally figured out my problem. In my case, I needed to set the Content-Type in the header to application/json.

ptc-8921310-MarbleAuthor
10-Marble
July 31, 2015

It seems the problem is Thingworx server is filtering the form data.

When I deselect Filter Content-Type in PlatformSubsystem configuration, it is allowing the post request

Now the question is how to pass the form data using post with default options of Filter Content-Type ?

ptc-8921310-MarbleAuthorAnswer
10-Marble
August 1, 2015

Resolved by using json content in post instead of plain text.

If you need to use plain text, then filter content option should be turned off.

richardmu1-Visitor
1-Visitor
August 4, 2015

Hello Shashikant,

good to know you have found a solution!

could you share example of your code that is working ?

thanks  a lot

Richard

ptc-8921310-MarbleAuthor
10-Marble
August 5, 2015

Hi Richard,

This should help you...

URL thingworx_rest_url = new URL(

  ACConfig.REST_BASEURI + "Resources/EntityServices/Services/CreateThing");

Create JSONObject and put all parameters and pass it to following API.

private static void executePostRequest(URL thingworx_rest_url,

  JSONObject inputObj) throws IOException, ProtocolException,

  JSONException {

  inputObj.put("appKey", ACConfig.AUTH_APPKEY);

  inputObj.put("x-thingworx-session", "true");

  System.out.println("URL:" + thingworx_rest_url.toExternalForm());

  String input = inputObj.toString();

  System.out.println("POSTData:" + input);

  HttpURLConnection http_connection = (HttpURLConnection) thingworx_rest_url

  .openConnection();

  http_connection.setRequestMethod("POST");

  http_connection.setDoOutput(true);

  http_connection.setRequestProperty("appKey", ACConfig.AUTH_APPKEY);

  http_connection.setRequestProperty("x-thingworx-session", "true");

  http_connection.setUseCaches(false);

  http_connection.setInstanceFollowRedirects(false);

  http_connection.setRequestProperty("Content-Type", "application/json");

  http_connection.setRequestProperty("charset", "UTF-8");

  try (DataOutputStream wr = new DataOutputStream(

  http_connection.getOutputStream())) {

  wr.write(input.getBytes());

  wr.flush();

  }

  System.out.println("RESPONSE:" + http_connection.getResponseCode());

  }

Terms & ConditionsAccessibility statement