Access token doesn't work passed in header

[slinlee]

The deployment only seems to use the API key if it's passed as a URL param. Can we switch it to use a header token?

Originally posted by @slinlee in #27 (comment)

[slinlee]

​curl -X 'POST' 
  'https://stock.devpathmind.com:8000/predict_raw/' \
  -H 'accept: application/json' 
  -H 'access_token: 1234567asdfgh' 
  -H 'Content-Type: application/json' 
  -d '{
  "obs": [
    0,1,2
  ]
}'

[slinlee]

@xneyder do we maybe strip headers when redirecting the request?

[maxpumperla]

@slinlee I've done most of my testing locally with header tokens, fwiw. should all be supported

[slinlee]

@slinlee I've done most of my testing locally with header tokens, fwiw. should all be supported

Yeah that's what I thought. I suspect something is lost when we redirect the request.

[slinlee]

Here are more details:

Putting the access token in the URL works for the zinc factory:

curl -X 'POST' \
  'https://zinc-factory.devpathmind.com/predict/?access_token=1234567asdfgh' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "minute": 0,
  "hour": 0,
  "day": 0,
  "month": 0,
  "price": 0
}'

But this command with the access token in the header fails:

curl -X 'POST' \
  'https://zinc-factory.devpathmind.com/predict/' \
  -H 'accept: application/json' \
  -H 'access_token: 1234567asdfgh' \
  -H 'Content-Type: application/json' \
  -d '{
  "minute": 0,
  "hour": 0,
  "day": 0,
  "month": 0,
  "price": 0
}'

[slinlee]

@xneyder was this ever resolved?

[xneyder]

Yes it was fixed with the ingress configuration we did.

[slinlee]

Thanks! closing this now.

[slinlee]

Closed in PathmindAI/pathmind-webapp#2971

[slinlee]

Here is a more recent example

curl -X 'POST' \
                                                     'https://api.dev.devpathmind.com/policy/id6969/predict/' \
                                                     -H 'accept: application/json' \
                                                     -H 'access_token: a90c01ad-8239-432c-9ebc-c79a79c41a07' \
                                                     -H 'Content-Type: application/json' \
                                                     -d '{
                                                     "callCenters": [
                                                       0
                                                     ],
                                                     "hour": 0,
                                                     "currentCall": [
                                                       0
                                                     ],
                                                     "links": [
                                                       0
                                                     ],
                                                     "minute": 0
                                                   }'

[xneyder]

Please user access-token instead of access_token, dash instead od underscore.

curl -v -X 'POST' \  ✔
'https://api.dev.devpathmind.com/policy/id6969/predict/'
-H 'accept: application/json'
-H 'access-token: a90c01ad-8239-432c-9ebc-c79a79c41a07'
-H 'Content-Type: application/json'
-d '{
"callCenters": [
0
],
"hour": 0,
"currentCall": [
0
],
"links": [
0
],
"minute": 0
}'

[slinlee]

Underscores are not recommended as header names. I'm going to switch to use access-token for the var name.

See: https://stackoverflow.com/questions/22856136/why-do-http-servers-forbid-underscores-in-http-header-names