Download attachement using authorization token in cookie

Data Services
1

Question on behalf of Tin The Nguyen:

Does A12 support download attachment without passing authorization in request header, but using authorization token in cookie?
I want to show uploaded image by using img tag with src attribute and its value is attachment download url, but because of security, this way doesn’t work.

2

Hi Tin,

There are only two options on how to access the data services server

  1. in a secure way where security is provided by UAA. UAA has dropped support for cookies a couple of releases back so I would say that if you want to use cookies you cannot secure it by UAA
  2. in an unsecure way where you can define endpoints as you see fit, and then exclude them from the security context using the following UAA configuration keymgmtp.a12.uaa.authentication.unsecured.urls. This way you will have to implement security using cookies by yourself.

From the data services point of view we see attachments as part of the documents therefore we demand that the security will be applied. You can still use the unsecure way approach and serve the attachments bypassing our security but I would not recommend this approach since it will compromise security of the server

Answer valid for Data services 33.0.9, 34.0.0

3

@tomas-thin-gale to clarify that: Is it possible to use 1.) for <img src="attachment_here"> tags?

4

Hi @guido-quiet-root,

The data services product does not handle HTML so I cannot really say what will happen if you have HTML code in your documents. However, I know for sure if you include in your src tag link to the attachment from the data services, it will not work without UAABearer token, which the browser cannot add there by default.

There is A12 ticket [A12-12207]<INTERNAL_LINK> where we evaluated the possibility of using expirable unsecured links for attachments. This way the browser can do the download by itself and your code snippet could work. Implementation of this ticket is however not yet planned. Therefore for forseeable future attachments in A12 are always returned as secured by UAA UAABearer tokens