Hi stoicflame- thanks for getting back to me. I had assumed that it was possible that proxy requests were communicating tokens in request headers, but Charles does not seem to pick them up. Regardless, I developed a standalone javascript app, that definitely DOES NOT use access tokens to retrieve the photos. Here is what Charles recorded. You can see near the end that I'm requesting photos directly from the localhost:8080/sparklr/rest/jpg/photo/ uri with not tokens in the request. N.B. I set up a virtual host on a local Apache Http Server called 'test.local'. I embedded the javascript client (below) into a html page and ran it from that location.
http://test.local/ 200 GET test.local
http://localhost:8080/sparklr/json/photos?callback=application.onLoadResourceManifest 302 GET
http://localhost:8080/sparklr/login.jsp;jsessionid=4EDC2013A400793A561C99CFDCE59 7AE 200 GET
http://localhost:8080/sparklr/oauth/user/authorize?client_id=tonr&redirect_uri=http://test.local/&response_type=code 302 GET
http://localhost:8080/sparklr/login.jsp;jsessionid=A9D8E0018EF3F83E3BD271409DECD B56 200
http://localhost:8080/sparklr/login.do 302 POST
http://localhost:8080/sparklr/oauth/user/authorize?client_id=tonr&redirect_uri=http://test.local/&response_type=code 302 GET
http://localhost:8080/sparklr/oauth/confirm_access 200 GET
http://localhost:8080/sparklr/oauth/user/authorize 302 POST
http://test.local/?code=i67LU0 200 GET test.local
http://localhost:8080/sparklr/json/photos?callback=application.onLoadResourceManifest 200 GET
http://localhost:8080/sparklr/rest/jpg/photo/1 200 GET
http://localhost:8080/sparklr/rest/jpg/photo/3 200 GET
http://localhost:8080/sparklr/rest/jpg/photo/5 200 GET
I'm not able to attach files for some reason, but here is the totality of the JavaScript client. The renderPhotos method (near end) is responsible for injecting the image tags into the DOM.
<script>
if ('function' != typeof Function.prototype.bind)
{
Function.prototype.bind= function (scope)
{
var func= this
, presetArgs= Array.prototype.slice.call(arguments, 1);
return function ()
{
return func.apply(scope, presetArgs.concat(arguments));
}
}
}
(
{
/**
* Initialize the application
*
* @private
* @param {boolean} [tryPhotoLoadWithoutAuth]
* @return {void}
*/
initialize: function (tryPhotoLoadWithoutAuth)
{
// export this object to the global scope
window.application= this;
if (this.isAuthenticated())
{
this.loadJsonResourceManifest();
}
else
{
this.setupAuthentication();
if (tryPhotoLoadWithoutAuth)
{
this.loadJsonResourceManifest();
}
}
}
/**
* Configuration settings
*
* @private
* @type {Object}
*/
, settings :
{
host : "http://localhost:8080/sparklr"
, authEndpoint : "/oauth/user/authorize"
, manifestUri: "/json/photos?callback=application.onLoadResourceManifest"
, resourceUri: "/rest/jpg/photo/"
, clientId : "tonr"
}
/**
* Get the sparklr resource manifest uri
* @return {string}
*/
, getJsonResourceManifestUri: function ()
{
return this.settings.host + this.settings.manifestUri;
}
/**
* Get the sparklr authentication endpoint
*
* @return {string}
*/
, getAuthUri : function()
{
return this.settings.host + this.settings.authEndpoint
}
/**
* Get the sparklr OAuth client id (aka consumer id)
* @return {string}
*/
, getClientId : function()
{
return this.settings.clientId;
}
/**
* Get the uri to which Sparklr should redirect to after
* authentication has completed. At the moment, its just
* this page
*
* @return {string}
*/
, getRedirectUri : function()
{
return window.location;
}
/**
* Try and locate an oauth security token in the applications
* uri, if it exists. If its not incuded in the url, the method
* returns null
*
* return {string|null}
*/
, findOAuthToken: function ()
{
if (this.oauthToken)
return this.oauthToken;
var match = location.search.match(/code=(\w+)/);
if (null != match)
this.oauthToken= match[1];
return this.oauthToken || null;
}
/**
* Determine if the application has been authenticated.
*
* @private
* @return {boolean}
*/
, isAuthenticated: function ()
{
return null != this.findOAuthToken();
}
/**
* Authenticate with Sparklr. Authentication is accomplished
* by rendering a link to Sparllrs authentication uri
*
* @private
* @return {void}
*/
, setupAuthentication: function ()
{
console.log("The client has not yet authenticated");
var authUri = this.getAuthUri() + "?client_id="
+ this.getClientId() + "&redirect_uri="
+ this.getRedirectUri() + "&response_type=code"
this.renderConnectButton(authUri);
}
/**
* Load the manifest detailing the photos available to retrieve from Sparklr
*
* @private
* @return {void}
*/
, loadJsonResourceManifest: function ()
{
var script= document.createElement('script');
script.src=this.getJsonResourceManifestUri();
script.onerror= this.onLoadResourceManifestFault.bind(this);
document.body.appendChild(script);
console.info("requesting resource manifest from " + script.src);
}
/**
* Calculate the sparklr uri from which to retrieve the protected photo
* @return {string}
*/
, calculatePhotoUri: function (photoId)
{
return this.settings.host + this.settings.resourceUri + photoId;
}
/**
* The resource manifest has loadewd
*
* @private
* @return {void}
*/
, onLoadResourceManifest: function (manifest)
{
this.renderPhotos(manifest.photos);
}
/**
* Render each photo as an image element
*
* @private
* @return {void}
*/
, renderPhotos: function (photoList)
{
photoList.forEach
(
function (photo)
{
var image= document.createElement('image')
image.src= this.calculatePhotoUri(photo.id);
document.body.appendChild(image);
console.info("added photo " + image.src)
}
, this
);
}
/**
* Render the connect button.
*
* @private
* @return {void}
*/
, renderConnectButton: function (uri)
{
$('<a href="'+uri+'">Connect to Sparklr</a>').appendTo(document.body);
}
/**
* Loading of the resource manifest from Sparklr failed.
*
* @private
* @param {Event} errorEvent
* @return {void}
*/
, onLoadResourceManifestFault: function (errorEvent)
{
console.dir(errorEvent);
throw new Error("Could not load resource manifest from " + this.getJsonResourceManifestUri());
}
}
)
.initialize(/*true*/);
</script>
This is very unusual. Is it possible that as no access token was provided, that the resources were not protected by the OAuth2ProtectedResourceFilter, and that the security filter chain cascaded, then recognising that the client had authenticated via http basic at the sparklr site, so allowing access? I confess, I don't understand.