Moqui session token

Technical Questions
1

A question:
I am right when i am saying the moquiSessionToken is not used in the REST interface?

Regards,
Hans at growerp.com

2

I disabled providing session tokens when using the REST interface and everything still working ok…

so to answer the question myself: no it is not used.

however should it be used?

3

If I recall correctly, the moquiSessionToken is for POST events to prevent xss POST in client side js.

1 Like
4

at the moment i do not provide a moquiSessionToken when accessing via the REST interface, and it is not giving me an error, so my understanding the moquiSessionToken is not used here?

5

I think that’s because you accessed a no-auth API. MoquiSessionToken is needed for authorized activities

1 Like
6

Yeah that’s right, and by default POST events from the REST API or transitions require authentication.

7

Thank for your replies, however below is a POST request of creating a company from a user who is logged in using the api_key but no moqui session token:
╔╣ Request ║ POST
║ http://localhost:8080/rest/s1/growerp/100/Company
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
╔ Headers
╟ content-type: application/json
╟ api_key: auM6cutFfsdyo7XAnpp4CiHkrGB6DCHTKxvgExiY
╟ contentType: application/json
╟ responseType: ResponseType.json
╟ followRedirects: true
╟ connectTimeout: 0:00:05.000000
╟ receiveTimeout: 0:00:10.000000
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
╔ Extras
╟ requireApiKey: true
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
╔ Body
╟ company: Company name: Test company[null] Curr: imgSize: null#Empl: 0
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
║ {company: Company name: Test company[null] Curr: imgSize: null#Empl: 0}

╔╣ Response ║ POST ║ Status: 200 OK
║ http://localhost:8080/rest/s1/growerp/100/Company
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
╔ Headers
╟ access-control-allow-credentials: [true]
╟ access-control-allow-origin: [http://localhost:39775]
╟ content-length: [183]
╟ content-type: [application/json]
╟ expires: [Thu, 01 Jan 1970 00:00:00 GMT]
╟ moquisessiontoken: [Nuaie-twmMBE908G7FpS]
╟ x-csrf-token: [Nuaie-twmMBE908G7FpS]
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
╔ Body
║
║ {
║ company: {
║ partyId: “102217”,
║ pseudoId: “102217”,
║ name: “Test company”,
║ role: “Customer”,
║ email: “”,
║ currency: null,
║ image: null,
║ address: null,
║ vatPerc: “0”,
║ salesPerc: “0”,
║ paymentMethod: null,
║ telephoneNr: “”,
║ employees:
║ }
║ }
║
╚═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

If You need need more info about the system please check github at : GitHub - growerp/growerp: GrowERP Flutter ERP for Android, IOS and Web using Moqui.org, Apache OFBiz the moqui system is in the directory ‘moqui’

Thanks for you help!
regards,
Hans

1 Like
8

There is an api_key in your request header. Moqui will call log-in with that key and the sessionToken is not needed any more. In other words, your are doing re-login in every request.
Notice that the moquiSessionToken is present in the response header, you should capture it for use in next requests, to save server resources.

1 Like
9

Thank you for the answer, very useful, will try it,
Regards,
Hans