Authentication, headers and HTTP status in REST
Separates credentials, authorization, transport and responses in Protheus REST.
Overview
Identify the implementation first: REST AdvPL/2.0 and tlppCore authentication configurations are not interchangeable. The Protheus flow documents Basic and Bearer. Basic encodes credentials in Base64 without encryption; use HTTPS. In JWT flows, send access_token in Authorization: Bearer; refresh_token belongs to renewal and does not replace the access token. Read expires_in from the response instead of assuming a universal lifetime. TOTVS states authentication is mandatory from release 12.1.2410: do not reuse old advice to disable Security. Keep credentials out of URLs, versioned code and logs. (TOTVS, n.d., refs. 1–4) Interpret 401 as requiring valid authentication and 403 as refusal to fulfill the request; 404 indicates a missing resource and 500 a server error. HTTP 200 does not replace validating the business result in the body. The example represents HTTP with a fictional domain, route and token, not a real endpoint call or a configuration recipe. (IETF, 2022, ref. 5)
Return value
No single return value: this is a composite workflow.
Commented example
GET /rest/test-resource HTTP/1.1
Host: api.example.invalid
Accept: application/json
Authorization: Bearer <ACCESS_TOKEN>No request was executed. Use a contracted resource route and obtain a token through the supported flow without publishing it. Handle status and body separately. Under review: editorial example neither compiled nor run in Protheus. Check includes, release, RDD and context before testing.
- Store secrets using an environment-appropriate mechanism, restrict permissions and renew tokens under the contract. Exclude Authorization, passwords and refresh_token from logs; test absent and expired tokens and unauthorized users.
- Under review: editorial example neither compiled nor run in Protheus. Check includes, release, RDD and context before testing.
Comments
There are no approved comments yet.
Sign in with Google or Microsoft to comment.