I am trying to execute this simple request on geonetwork, which should give me catalog statistics details (about private datasets for the corresponding user).


It works, when I add basic authentication credentials, but it does not, when I add a JSESSIONID cookie.

I create a new Geonetwork session, getting this cookie back:

Set-Cookie: JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D; Path=/geonetwork/

When I send this cookie with the above request, tomcat receives this request (from the catalina log):

"GET /geonetwork/srv/eng/q?_content_type=json&summaryOnly=true HTTP/1.1" 200 343 "serverTime=1489326597903; sessionExpiry=1489326597903; JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D"

For me, this looks good. But geonetwork does answer the request just with the dataset statistics, that are public. Private datasets will be excluded from the response.

I examined the requests made in the Geonetwork UI and they look exactly like what I am sending. Is there anything that I miss out at this point?


I am using version 3.0.3 of GeoNetwork.

The good point is: If I test from the Firefox RESTClient with a JSESSIONID created by logging in via the user interface, the session is actually recognized for private access.

So the problem seems to be in my code, where I create a new GeoNetwork session.

  • If I call with wrong username/ password, GeoNetwork gives me a 200 OK but no JSESSIONID.
  • If I call with correct username/ password, GeoNetwork will give me a 200 OK and a JSESSIONID. But apparently, the JSESSIONID does not seem to be qualified to access private datasets.

What I am basically doing to get the session id, is

Map<String, String> headers = new HashMap<>();
headers.put("Content-Type", "application/x-www-form-urlencoded");

String url = "http://localhost:8080/geonetwork/j_spring_security_check";
String body = "username="+userLogin+"&password="+userPass;

URLResponse r = HttpURLClient.sendRequest(url, headers, body, HttpMethod.POST);

Is that call to j_spring_security_check probably wrong?

  • 1
    That should work on latest GeoNetwork. Can you add more information? Like what version of GeoNetwork are you using or what is your code to do this request, maybe it is your client side. Mar 13, 2017 at 10:19
  • @Délawen I edited my question with some more information and the version I am using.
    – ulrich
    Mar 13, 2017 at 13:11
  • were you able to authenticate sending userLogin and userPass to geonetwork URL? Dec 30, 2020 at 21:14
  • @AN10 it should be described in my own answer below. I haven't used it for a while so I would need to check source code to dive into it again. I think the important part was to POST your Authorization header to j_spring_security_check and follow redirects on the response.
    – ulrich
    Jan 2, 2021 at 10:44
  • @ulrich Have you did any modification in config files of geonetwork because I tried as in my post gis.stackexchange.com/questions/383224/…, I followed those steps but not getting the JSESSION Jan 4, 2021 at 16:57

1 Answer 1


Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.

GeoNetwork does two 302 redirects before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.

If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.

Here my manual redirect output, in case it is relevant to somebody:

(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter failure=true, but the final operation is sucessful anyway.)

Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
Response Code : 302
Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]

Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 302
Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: null

Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 200
Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]

So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good. I hope, it's not a temporary endpoint that changes frequently.

EDIT: My current POST login request just uses the credentials in the Authorization header. I don't send anything in the body so I also don't need the Content-Type header.

After testing this again, somehow, querying the catalog.signin endpoint didn't work for me now, when I want to use the response JSESSIONID to login to GeoNetwork.

What I had to do is to query http://localhost:8080/geonetwork/j_spring_security_check and exactly follow all 302 redirects with my HTTPClient including issued cookies (intermediate sessionid's), as said above.

I use java.net.HttpURLConnection, which has a default follow redirect property, which I had to set to false: con.setInstanceFollowRedirects(false); This is due to the fact, that this does not seem to include cookies by default when doing redirects, so it does not work in this case and I had to do the redirects manually.

  • I use this method but I dont get a valid JSESSIONID .I can't use private services from geonetwork
    – Damak Hela
    May 1, 2017 at 23:57
  • @DamakHela have you tried to follow the redirects correctly or use the endpoint catalog.signin, which I specified at the end of the post?
    – ulrich
    May 2, 2017 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.