API stopped working after update

[treborrx]

Describe the bug

API doesn't work the way it did before after updating from 9.3.0 to both 9.3.2 and 9.3.3 (separately in test environment)
Previously after sending GET request to /apirest.php/initSession I received JSON with session_token. After update it returns html page (looks like login page).

[EDIT] Requesting without tokens returns "ERROR_APP_TOKEN_PARAMETERS_MISSING", as expected.

Page(s) URL

<site_url>/apirest.php/initSession

To reproduce

Update Glpi (cliupdate.php)

1. Go to <site_url>/apirest.php/initSession with app token and user token.

Expected behavior

JSON with session token returned.

Logs

Nothing logged (log level 5, logs in files: "yes")

Your GLPI setup (you can find it in Setup > General menu, System tab)

Operating system: Linux XXX 4.17.8 #3 SMP Fri Aug 10 09:22:43 CEST 2018 x86_64
PHP 7.0.30-0+deb9u1 apache2handler (Core, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, apc, apcu,
calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, json, ldap, libxml, mbstring,
mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, standard, sysvmsg, sysvsem, sysvshm,
tokenizer, wddx, xml, xmlreader, xmlrpc, xmlwriter, xsl, zlib)
Setup: max_execution_time="30" memory_limit="512M" post_max_size="8M" safe_mode="" session.save_handler="files"
upload_max_filesize="2M"
Software: Apache/2.4.25 (Debian) (Apache/2.4.25 (Debian) Server at XXX Port 443)
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Server Software: Debian 9.1
Server Version: 10.1.26-MariaDB-0+deb9u1
Server SQL Mode:
Parameters: glpi@localhost/glpi
Host info: Localhost via UNIX socket

mysqli extension is installed
ctype extension is installed
fileinfo extension is installed
json extension is installed
mbstring extension is installed
zlib extension is installed
curl extension is installed
gd extension is installed
simplexml extension is installed
xml extension is installed
ldap extension is installed
imap extension is installed
Zend OPcache extension is installed
APCu extension is installed
xmlrpc extension is installed
CAS extension is installed
Database version seems correct (10.1.26) - Perfect!Database version seems correct (10.1.26) - Perfect!
OK/var/log/glpi : OK
OK/etc/glpi/config : OK
OK/var/lib/glpi/files : OK
OK/var/lib/glpi/files/_dumps : OK
OK/var/lib/glpi/files/_sessions : OK
OK/var/lib/glpi/files/_cron : OK
OK/var/lib/glpi/files/_graphs : OK
OK/var/lib/glpi/files/_lock : OK
OK/var/lib/glpi/files/_plugins : OK
OK/var/lib/glpi/files/_tmp : OK
OK/var/lib/glpi/files/_cache : OK
OK/var/lib/glpi/files/_rss : OK
OK/var/lib/glpi/files/_uploads : OK
OK/var/lib/glpi/files/_pictures : OK

Additional context

Updated with cliupdate.php withut errors.
Using Python Requests module.

[orthagh]

Hello.

I can't replicate the issue.
Are you sure you didn't change anything else ?
Could you check in GLPI Setup > Api menu if everything if enabled ?

Also you can test in browser directly (parameters can passed in query string like /apirest.php/initSession?user_token=xxx&app_token=yyy (warning App-Token becomes app_token)

[StephaneDci]

Hello

EDIT : found usefull information here: #4386

Just to be sure I encounter some kind of same problem since I migrate from 9.2.3 => 9.3.3 version

In version 9.2.3 for exemple I used to pass in request HTTP Header the APP Token and the user_token
like that and it was working great.

9.2.3 version
curl -vvvv -k -X GET \ -H 'Content-Type: application/json' \ -H "Authorization: user_token XXXX" \ -H "App-Token: ZZZZ" \ 'https://<url>/apirest.php/initSession'

9.3.3 version the same request gives me:
["ERROR_LOGIN_PARAMETERS_MISSING"]

After multiples tries I found that it works with this kind of request
curl -vvvv -k -X GET \ -H 'Content-Type: application/json' \ -H "App-Token: ZZZZ" \ 'https://<url>/apirest.php/initSession?user_token=XXXX'

And I finally get
{"session_token":"979f4228040b8996177cb6b1ab3329fa"}

Could you confirm there have been a changed in the API auth method ?

I cannot find any reference to that in documentation nor in the source code
Regards

[orthagh]

No changes has been done on this part but did you change or upgraded your web server ? or change php from apache module to fpm mode ?

Authorization header in apache+php-fpm are not send by default, you need to do some action on you system to enable them.

See this topic for example: https://stackoverflow.com/a/17490827