I am trying to execute this simple request on geonetwork, which should give me catalog statistics details (about private datasets for the corresponding user).


It works, when I add basic authentication credentials, but it does not, when I add a JSESSIONID cookie.

I create a new Geonetwork session, getting this cookie back:

Set-Cookie: JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D; Path=/geonetwork/

When I send this cookie with the above request, tomcat receives this request (from the catalina log):

"GET /geonetwork/srv/eng/q?_content_type=json&summaryOnly=true HTTP/1.1" 200 343 "serverTime=1489326597903; sessionExpiry=1489326597903; JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D"

For me, this looks good. But geonetwork does answer the request just with the dataset statistics, that are public. Private datasets will be excluded from the response.

I examined the requests made in the Geonetwork UI and they look exactly like what I am sending. Is there anything that I miss out at this point?


I am using version 3.0.3 of GeoNetwork.

The good point is: If I test from the Firefox RESTClient with a JSESSIONID created by logging in via the user interface, the session is actually recognized for private access.

So the problem seems to be in my code, where I create a new GeoNetwork session.

  • If I call with wrong username/ password, GeoNetwork gives me a 200 OK but no JSESSIONID.
  • If I call with correct username/ password, GeoNetwork will give me a 200 OK and a JSESSIONID. But apparently, the JSESSIONID does not seem to be qualified to access private datasets.

What I am basically doing to get the session id, is

Map<String, String> headers = new HashMap<>();
headers.put("Content-Type", "application/x-www-form-urlencoded");

String url = "http://localhost:8080/geonetwork/j_spring_security_check";
String body = "username="+userLogin+"&password="+userPass;

URLResponse r = HttpURLClient.sendRequest(url, headers, body, HttpMethod.POST);

Is that call to j_spring_security_check probably wrong?

  • 1
    That should work on latest GeoNetwork. Can you add more information? Like what version of GeoNetwork are you using or what is your code to do this request, maybe it is your client side. – María Arias de Reyna Domínguez Mar 13 '17 at 10:19
  • @Délawen I edited my question with some more information and the version I am using. – ulrich Mar 13 '17 at 13:11

Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.

GeoNetwork does two 302 redirects before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.

If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.

Here my manual redirect output, in case it is relevant to somebody:

(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter failure=true, but the final operation is sucessful anyway.)

Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
Response Code : 302
Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]

Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 302
Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: null

Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 200
Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]

So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good. I hope, it's not a temporary endpoint that changes frequently.

EDIT: My current POST login request just uses the credentials in the Authorization header. I don't send anything in the body so I also don't need the Content-Type header.

After testing this again, somehow, querying the catalog.signin endpoint didn't work for me now, when I want to use the response JSESSIONID to login to GeoNetwork.

What I had to do is to query http://localhost:8080/geonetwork/j_spring_security_check and exactly follow all 302 redirects with my HTTPClient including issued cookies (intermediate sessionid's), as said above.

I use java.net.HttpURLConnection, which has a default follow redirect property, which I had to set to false: con.setInstanceFollowRedirects(false); This is due to the fact, that this does not seem to include cookies by default when doing redirects, so it does not work in this case and I had to do the redirects manually.

  • I use this method but I dont get a valid JSESSIONID .I can't use private services from geonetwork – Damak Hela May 1 '17 at 23:57
  • @DamakHela have you tried to follow the redirects correctly or use the endpoint catalog.signin, which I specified at the end of the post? – ulrich May 2 '17 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.