REST sessions broken or not a valid way to use the REST interface

[colbyw]

Issue posted here: http://issues.civicrm.org/jira/browse/CRM-12423, text from the issue below for discussion.

While working on REST unit tests, I discovered that there is no way to use the REST interface using the given PHPSESSID you receive when logging in. In the wiki (http://wiki.civicrm.org/confluence/display/CRMDOC43/REST+interface), it states that you can use the site key or PHPSESSID with a valid api_key, however I get an error when I don't include the site key in every call.

FATAL: mandatory param 'key' missing. More info at: http://wiki.civicrm.org/confluence/display/CRMDOC/Managing+Scheduled+Jobs

[Erik Hommel]

however I get an error when I don't include the site key in every call.

As far as I know you always have to include the site key, and you can include de PHPSESSID or the api_key. I always use the api_key, so I am not sure if the PHPSESSID still works in the latest versions. But yes, you always need the site key in every call.

[totten]

The issue was also discussed briefly outside the forum -- so far, Xavier, Erik, and Nicholas support the idea of removing the older "PHPSESSID+site_key" support, and no one has piped up to defend "PHPSESSID+site_key". The discussion hasn't been very concrete about where/how to remove it, so I want to explicate the options here.

a) Remove from 4.3. Update the API changelog for 4.3. Update the wiki and book to indicate that PHPSESSID is no longer supported.

b) Fix 4.3 and keep it. (Note: We have draft unit tests in https://github.com/civicrm/civicrm-core/pull/541 to prevent future regression.)

c) Fix 4.3. Remove from 4.4. Update the API changelog for 4.4. Update the wiki and book to indicate that PHPSESSID is deprecated.

d) Leave 4.3 broken. Remove from 4.4. Update the API changelog for 4.4. Update the wiki and book to indicate that PHPSESSID is deprecated.

Options "c" and "d" seem silly to me -- e.g. "c" since we incurs the same cost as "b" but ultimately break backward compatibility anyway. The decision here obviously falls on the API team, but I think we should be explicit about which path we're taking here.

[xavier]

a) Update doc and clarify that api_key&key couple is the one and only way to authenticate on rest (if you want session, use civicrm/ajax/rest)

What do you mean by api changelog?

X+

[totten]

"API changelog" refers to this wiki page:

http://wiki.civicrm.org/confluence/display/CRMDOC43/API+changes

[totten]

Done:
 * Remove dead code from CRM_Utils_REST
 * Update WebTest_Utils_RestTest
 * Update http://wiki.civicrm.org/confluence/display/CRMDOC43/API+changes
 * Update http://wiki.civicrm.org/confluence/display/CRMDOC43/API+Reference

The following documents still have issues -- i.e. they mention "q=civicrm/login" and/or play loose with the differences between "/civicrm/ajax/rest" and "extern/rest.php":

 * http://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface
 * http://booki.flossmanuals.net/civicrm-developer-guide/_draft/_v/1.0/api/

Could someone tweak those?

[Michael McAndrew]

we can use jira for these now - http://issues.civicrm.org/jira/browse/CRM-12564 I assigned this to you, tim - feel free to re-assign

[xavier]

Did change the wiki, not sure if we should keep all these examples, might be better to simply refer to the main api doc once we have introduced the rest.php syntax?

Erik is working on the book, not sure where he is on that

[Erik Hommel]

I have sent the concept to the API list, got lots of useful comment. That is not fixed in a week thought, so I will ask Michael to publish the chapter as it is. It is at least more up to date than the current one.

[Michael McAndrew]

Erik - do you want to take on / resolve this ticket then: http://issues.civicrm.org/jira/browse/CRM-12564