RESTful data access issue when using HTTP DELETE method
I am having a problem accessing the raw request information from PHP while accessing the script using the HTTP DELETE directive. I am using front end JS that accesses the script using Ajax. This script is actually part of a RESTful API that I am developing.
End point in this example:
This endpoint is used to create an authentication token that can be used for subsequent API requests. Using the GET method on this URL along with a modified version of HTTP Basic Authentication will provide an access token for the client. This token must be included in all other interactions with the service before it expires.
Once the token is generated, it is returned to the client in the format specified by the "Accept" header that the client sends to the service; in this case "application / json". Upon success, it responds with HTTP status code 200 Ok. On failure, it throws an exception using HTTP 401 authorization code.
Now when you want to delete a session or "log out", you are taken to the same URL, but with the HTTP DELETE directive. To verify access to this endpoint, the client must prove that they were pre-authenticated by providing the token they want to complete.
If they are "logged in", the token and session are ended and the service must respond with a 204 No Content HTTP status code, otherwise they encounter a 401 exception again.
Now the problem is deleting sessions. With the DELETE directive using Ajax, I cannot access any of the parameters that I have set when the request hits the service. In this case I am looking for a parameter called "token".
I am looking at the raw request headers using Firebug and I notice that the Content-Length header changes with the size of the token being sent. This tells me that this data is indeed being sent to the server.
The question is, using PHP, how the hell am I accessing parameter information? It is not a POST or GET request, so I cannot access it as usual in PHP. The parameters are within the portion of the request content.
I tried looking at $ _SERVER, but that shows me a limited number of headers. I tried "apache_request_headers ()" which gives me more details, but still for headers only. I even tried 'file_get_contents (' php: // stdin '); and i get nothing.
How can I access some of the content of a raw HTTP request?
Sorry for the long post, but I realized that too much information is better than too little. :)
a source to share
I think you are using HTTP DELETE incorrectly. It should usually be used as a request to delete a resource on the server: the resource pointed to by the request URI. You can encode the access token as a request parameter, but you shouldn't use DELETE. for example a request:
DELETE /somescript.php?token=XYZ123
SHOULD be treated as a request to remove the file "somescript.php" from the server.
You must rewrite your system to use POST request, which is the usual way of doing things like this. The POST script handler can delete the session and respond with appropriate headers to disable the cookies you may have created.
a source to share