Centreon: "Unauthorized" when trying to query REST API via curl

[anzevi]

Hi,

I'm unable to get any valid response back from REST API. User has the permission to reach API, I can get the token, but whenever I try to query API via curl i get 401 "Unauthorized" back.

---

BUG REPORT INFORMATION

Centreon version: centreon-2.8.2

Centreon Web version: centreon-web-2.8.2

Centreon Engine version: centreon-engine-1.6.2

Centreon Broker version: centreon-broker-3.0.3

OS: CentOS Linux release 7.3.1611 (Core)

Additional environment details (AWS, VirtualBox, physical, etc.): vmware

Steps to reproduce the issue:

1. setup user to allow access to REST api
2. get token for this user:

curl -s --data 'username=<username>&password=<password>' 'http://centreon.home.local/centreon/api/index.php?action=authenticate'

1. Run this curl to list hosts:

curl -s 'http://centreon.home.local/centreon/api/index.php?action=action&object=centreon_clapi' -H 'Content-Type: application/json' -H 'centreon_auth_token: XXXXXXXXXXXXXXXXXXXXXX=' --data 'action=show&object=HOST'

Describe the results you received: "Unauthorized"

Additional information you think important (e.g. issue happens only occasionally):
I tried this with different users, with different permission, every time is the same response.

• PHP 5.3.3
• httpd-2.2.15

[julienmathis]

Hello,

I think you have problem with your second command. Please test with this command :

curl -s 'http://centreon.home.local/centreon/api/index.php?action=action&object=centreon_clapi' -H 'Content-Type: application/json' -H 'centreon_auth_token: XXXXXXXXXXXX=' --data '{"action":"show", "object":"HOST"}'

Best regards

[anzevi]

hi and thanks for your reply. I tried with this command as well, still getting "Unauthorized" back. I tried this curl with every shape and form that is supported by JSON but no luck. I decided to report this since I ran out of ideas and this should be pretty straightforward.

[leoncx]

Hi,

In version 2.4 of apache, the headers have some new security rules :

Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped.

But you can use the header name centreon-auth-token instead centreon_auth_token.

Can you test with this header ?

[lpinsivy]

commit bb3f201

[anzevi]

Can you test with this header ?

tested and I can confirm it works with this headers 👍

Thanks!

[itsul]

We can confirm the issue too, with "-" instead of "_" the API is working.

Could you edit your documentation at https://documentation.centreon.com/docs/centreon/en/2.8.x/api/api_rest/index.html please?