Problem with authentication... Acts As Authenticated

Rails
1

Hello,

I am working on the API of our webservice. API users need to
authenticate some of their calls…
When I am performig the call through Firefox, everything is fine as
shown in the log :

Processing OwnershipsController#new (for 67.207.118.174 at 2008-09-26
16:20:03) [GET]
Session ID:
BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo
SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595
Parameters: {“format”=>“xml”, “action”=>“new”,
“controller”=>“sources/ownerships”, “password”=>“MYPASS”,
“login”=>“MYUSER”, “source_id”=>“1247”}
Completed in 0.01454 (68 reqs/sec) | Rendering: 0.00705 (48%) | DB:
0.00378 (25%) | 200 OK
[http://site.com/sources/1247/ownerships/new.xml?login=
MYUSER&password=MYPASS]

However, if I perform the exact same call from an external client
wirtten in Perl, here is what I get n my log :

Processing OwnershipsController#new (for 67.202.41.41 at 2008-09-26
16:19:39) [GET]
Session ID: 6ef6e5b8289004d925517d48294f1cc1
Parameters: {“format”=>“xml”, “action”=>“new”,
“controller”=>“sources/ownerships”, “password”=>“MYPASS”,
“login”=>“MYUSER”, “source_id”=>“1247”}
Filter chain halted as [:login_required] rendered_or_redirected.
Completed in 0.00284 (351 reqs/sec) | Rendering: 0.00066 (23%) | DB:
0.00000 (0%) | 401 Unauthorized
[http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS]

As you can see the parameters are precisely the same and, in one case,
the call is successful while in another case it’s not!

Do you guys have any idea on how to solve this?

Thanks a lot!

2

Firefox

Session ID:
BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo
SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595

Perl

Session ID: 6ef6e5b8289004d925517d48294f1cc1

Give the vast difference between these two Session IDs it makes me
wonder if that is related to you problem? Does this relate in any way to
“cross-site forgery protection?”

Julien Genestoux wrote:

Hello,

I am working on the API of our webservice. API users need to
authenticate some of their calls…
When I am performig the call through Firefox, everything is fine as
shown in the log :

Processing OwnershipsController#new (for 67.207.118.174 at 2008-09-26
16:20:03) [GET]
Session ID:
BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo
SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595
Parameters: {“format”=>“xml”, “action”=>“new”,
“controller”=>“sources/ownerships”, “password”=>“MYPASS”,
“login”=>“MYUSER”, “source_id”=>“1247”}
Completed in 0.01454 (68 reqs/sec) | Rendering: 0.00705 (48%) | DB:
0.00378 (25%) | 200 OK
[http://site.com/sources/1247/ownerships/new.xml?login=
MYUSER&password=MYPASS]

However, if I perform the exact same call from an external client
wirtten in Perl, here is what I get n my log :

Processing OwnershipsController#new (for 67.202.41.41 at 2008-09-26
16:19:39) [GET]
Session ID: 6ef6e5b8289004d925517d48294f1cc1
Parameters: {“format”=>“xml”, “action”=>“new”,
“controller”=>“sources/ownerships”, “password”=>“MYPASS”,
“login”=>“MYUSER”, “source_id”=>“1247”}
Filter chain halted as [:login_required] rendered_or_redirected.
Completed in 0.00284 (351 reqs/sec) | Rendering: 0.00066 (23%) | DB:
0.00000 (0%) | 401 Unauthorized
[http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS]

As you can see the parameters are precisely the same and, in one case,
the call is successful while in another case it’s not!

Do you guys have any idea on how to solve this?

Thanks a lot!