topic custom header values for http request in ArcGIS Runtime SDK for iOS Questions

custom header values for http request

LukePhilips — Wed, 11 Apr 2012 21:42:40 GMT

when adding various service URI's to the map, is it possible to set custom header values to the http request that the ESRI iOS api is making to my arcgis server? The intention here is get through a security policy that places usernames/passwords in the headers.

Re: custom header values for http request

DiveshGoyal — Thu, 03 May 2012 22:30:27 GMT

Unfortunately, this is not possible at this time.

Could you please elaborate on the security policy you're referring to. The API already supports ArcGIS Server security model (Basic/Digest/Token).
If we have more information about your needs we can try and suggest ways to meet them or build provisions in the API for a future release.

Re: custom header values for http request

LukePhilips — Tue, 08 May 2012 15:23:35 GMT

Unfortunately, this is not possible at this time.

Could you please elaborate on the security policy you're referring to. The API already supports ArcGIS Server security model (Basic/Digest/Token).
If we have more information about your needs we can try and suggest ways to meet them or build provisions in the API for a future release.

Instead of relying on ArcGIS Server for security, we have a 'mediation platform' (think Layer 7 or Tibco) to give a front end for all service calls to the back-end enterprise. This also handles the security up front and lessens the need for the back end enterprise to try to stay in sync with evolving security access/profiles. Once authenticated this provides basically a pass-through to the ArcGIS Server endpoints, using token values specified in the http request header, not URL parameters. Other http request header values provide for various other logging/tracking of service calls. What I would like simply would be more access to the http request object.

Re: custom header values for http request

LukePhilips — Wed, 16 May 2012 21:19:37 GMT

Let me add some details to my request. What we have implemented as a security mechanism in front of our services is modeled after OAuth2, and for the OAuth 2.0 API you can pass through your tokens/username/password has header values or URI params, we limit it to header values. Is this type of security planned for the ESRI api's?

Another thought is if it would be possible to have the ESRI api make a request to a URI that is nothing more than 'http://localhost', then for me to intercept that and make the call myself with the Oauth security.

Re: custom header values for http request

GlobalSBB — Tue, 08 Nov 2016 13:24:35 GMT

Any news about this issue? We have the same requirement, we need to pass custom headers required by our reverse proxy.

I saw that this will be possible with the new Quartz SDK (AGSRequestConfiguration::useHeaders :

https://developers.arcgis.com/ios/beta/api-reference//interface_a_g_s_request_configuration.html#a47fd4ec9f76579aeab5b7c74a6f68fe6) so I guess we have to wait for it.

Re: custom header values for http request

YueWu1 — Tue, 08 Nov 2016 18:01:53 GMT

Hi Terrettaz,

I find this userHeaders method is available in 10.2.5 (current version of SDK) 10.2.5: AGSRequestOperation Class Reference

Maybe you can try to use this.

Re: custom header values for http request

DiveshGoyal — Mon, 28 Nov 2016 22:06:14 GMT

Yes, we plan to support sending the oAuth details through headers instead of URI params in a future release.