Getting token without providing credentials

Question

In Getting correct sign-in token for ArcGIS REST Service using ArcPy with ArcGIS Pro I found that I was trying to use a token received from one source, on a different server, which didn't work.

Now I'm sure I'm staying with the same service, but I'm caught in a loop.

My "ArcGIS REST Services Directory" is located at https://<server>.<domain>/arcgis/rest/services and looks like this in a web browser:

Home > services Help | API Reference
JSON | SOAP
Folder: /
Current Version: 10.71
...

So, now I try and acquire a token:

# create a session object
s = requests.Session()
  
# set username and password
s.auth = (username, password)

url = 'https://<server>.<domain>/arcgis/tokens/generateToken'
response = s.post(url)
print ('RESPONSE: ' , end = '')
print (response) 

print ("\n")
print (response.text)

and get this:

     URL: https://<server>.<domain>/arcgis/tokens/generateToken
RESPONSE: <Response [200]>

Invalid request <br>Usage: https://<server>.<domain>/arcgis/tokens?request=gettoken&username=username&password=password&<br>Usage: https://<server>.<domain>/arcgis/tokens/generateToken?username=username&password=password&<br>Usage: https://<server>.<domain>/arcgis/tokens/gettoken.html<br>

As I understand it, I must supply credentials to acquire the token, which makes sense. So I use the instruction given in the failed response, and supply this:

URL: https://<server>.<domain>/arcgis/tokens/generateToken?username=_________&password=________
RESPONSE: <Response [405]>

which gets this:

Generate Token request should not contain username and password in the query string.

Answer 1

If you think of HTTPS security as using a postal system, a GET uses a postcard, and a POST uses a security envelope. Unfortunately, to extend the metaphor, you've written the username and password on the front of the envelope in an "Attention:" block. What is needed is to place this information inside the envelope.

The mechanisms for doing this vary by language and library, but it seems that with requests in Python3, you need to include the optional data parameter in the request as a dictionary:

import requests
import json

url = 'https://localhost:6443/arcgis/tokens/generateToken'

admUser = '#Redacted'
admPass = '#Redacted'
try:
    params = {  'f'           : 'json'    # {json,pjson,html}
              , 'username'    : admUser
              , 'password'    : admPass
              , 'client'      : 'requestip'
              , "expiration"  : '180'     # 3-Hour batch job
              }
    result = requests.post(url,data=params,verify=False)
    parsed = json.loads(result.text)
    print(json.dumps(parsed, indent=4))
    agsToken = parsed['token']
    
except SSLError as e:
    print(e)

returns:

{
    "token": "seriouslyRedactedWallaWallaWashingtonPlusABunchOfTrashAndOnAndOn",
    "expires": 9999999999999
}