0

Our arcgis server was just upgraded from 10.2.x to 10.6 and after this upgrade was done we started to encounter an issue when generating a token to access the arcgis services.

The token generation process calls the service from arcgisurl/tokens/generateToken and we pass the parameters as follows:

string url = ConfigurationManager.AppSettings["ArcGIS_Server_URL"] + "/tokens/generateToken/?f=pjson";

            string data = string.Format("username={0}&password={1}&client=requestip&expiration={2}", username, password, ConfigurationManager.AppSettings["TokenExpirationTime"]);

            url = string.Format("{0}&{1}", url, data);

            // Create a new web request
            CustomWebRequest request = new CustomWebRequest(url, "POST");
            //Get Response
            string requestResult = request.GetResponse();

Under arcgis server 10.2.x this was fine, however with 10.6.x we get the error:

Generate Token request should not contain username and password in the query string

Also I noticed that if I try to access the token generator url from the browser the form comes up, however when I enter the username and password and requestip it returns invalid if done from an external pc. If I try to do the same thing from on the server itself then the token is generated fine, however I don't think that this has any effect as running the application directly on the server still gives the token generation issue.

I also upgraded the proxy to reflect 10.3.x as there was this issue from the query string for that server however this didn't help either.

Has anyone else encountered this issue and if so is there anything that can be done to resolve it?

  • Your request is inherently insecure. You need to POST the password within the body of the request (as the error message indicates) – Vince Mar 14 '18 at 10:23
  • Would you post the password as a string anyway or as an object though? – Maeglin77 Mar 14 '18 at 10:31
  • Neither. The data stream has a required format, though I've only used JavaScript to encode it, long, long ago. – Vince Mar 14 '18 at 10:39
0

The issue was solved with the following solution thanks to @Vince :

Previously as in the above code snippet the username and password were being passed in the string request, however I extracted these and passed them as a separate string in the body as below:

string url = ConfigurationManager.AppSettings["ArcGIS_Server_URL"] + "/tokens/generateToken/?f=pjson";

string sensData = string.Format("username={0}&password={1}", username, password);
        string data = string.Format("username={0}&password={1}&client=requestip&expiration={2}", username, password, ConfigurationManager.AppSettings["TokenExpirationTime"]);

        url = string.Format("{0}&{1}", url, data);

        CustomWebRequest request = new CustomWebRequest(url, "POST", sensData);         
        string requestResult = request.GetResponse();

The CustomWebRequest method is also encoding the string object into the correct format for the posted data stream, and in this way the token was returned successfully.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.