Generating Tokens after ArcGIS Server upgrade?

Question

Our ArcGIS Server was just upgraded from 10.2.x to 10.6 and after this upgrade was done we started to encounter an issue when generating a token to access the ArcGIS services.

The token generation process calls the service from arcgisurl/tokens/generateToken and we pass the parameters as follows:

string url = ConfigurationManager.AppSettings["ArcGIS_Server_URL"] + "/tokens/generateToken/?f=pjson";

            string data = string.Format("username={0}&password={1}&client=requestip&expiration={2}", username, password, ConfigurationManager.AppSettings["TokenExpirationTime"]);

            url = string.Format("{0}&{1}", url, data);

            // Create a new web request
            CustomWebRequest request = new CustomWebRequest(url, "POST");
            //Get Response
            string requestResult = request.GetResponse();

Under arcgis server 10.2.x this was fine, however with 10.6.x we get the error:

Generate Token request should not contain username and password in the query string

Also I noticed that if I try to access the token generator url from the browser the form comes up, however when I enter the username and password and requestip it returns invalid if done from an external PC. If I try to do the same thing from on the server itself then the token is generated fine, however I don't think that this has any effect as running the application directly on the server still gives the token generation issue.

I also upgraded the proxy to reflect 10.3.x as there was this issue from the query string for that server however this didn't help either.

Has anyone else encountered this issue and if so is there anything that can be done to resolve it?

Answer 1

The issue was solved with the following solution thanks to @Vince :

Previously as in the above code snippet the username and password were being passed in the string request, however I extracted these and passed them as a separate string in the body as below:

string url = ConfigurationManager.AppSettings["ArcGIS_Server_URL"] + "/tokens/generateToken/?f=pjson";

string sensData = string.Format("username={0}&password={1}", username, password);
        string data = string.Format("username={0}&password={1}&client=requestip&expiration={2}", username, password, ConfigurationManager.AppSettings["TokenExpirationTime"]);

        url = string.Format("{0}&{1}", url, data);

        CustomWebRequest request = new CustomWebRequest(url, "POST", sensData);         
        string requestResult = request.GetResponse();

The CustomWebRequest method is also encoding the string object into the correct format for the posted data stream, and in this way the token was returned successfully.

Answer 2

I had success by putting the credentials in the body as type Application/x-www-form-urlencoded as per the documentation (https://developers.arcgis.com/rest/services-reference/enterprise/generate-token.htm)