It’s common to use HTTP basic authentication when trying out the ReST API.
However, the basic auth mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with Base64 in transit, but not encrypted or hashed in any way. Therefore, basic Authentication is typically used in conjunction with HTTPS to provide confidentiality.
Alfresco ReST API also provides another way of authenticating with the repository. The APIs also support the Alfresco ticket mechanism. You can POST the following body to http://localhost:8080/alfresco/api/-default-/public/authentication/versions/1/tickets to create a new ticket:
{
"userId": "admin",
"password": "admin"
}
The response provides the ticket in the id property:
{
"entry": {
"id": "TICKET_ed4981b4bbb15fc2713f7caaffd23982d0dd4e5c",
"userId": "admin"
}
}
This ticket can then be used instead of a username and password. Although the ReST API supports the alf_ticket query parameter, we do not recommend using it, a more secure approach is to use a HTTP header. The basic auth mechanism is still used i.e. sending an Authorisation header. However, the base64 encoded username/password is replaced with the base64 encoded ticket.
How to get a ticket and how to use it is explained in Authenticate with the Repository in the ReST API user guide.