ArcGIS token security and Silverlight controls

[Anonymous User]

Original User: jmurdoch

After generating a token for a secured ArcGIS Map Service, I'm able to programmatically retrieve the attachment list resource for a particular feature.  However, if I use this token to try to open an attachment in the browser via XAML, I am forwarded to the service login page instead. 

Presumably, this is because the HTTP referrer used to generate the token is not the same referrer used to open the attachment in the browser.  I'm wondering if there are any thoughts/solutions/work-arounds for this.  I'd like to be able to do the following:

     <HyperlinkButton Content="{Binding Name}" TargetName="_blank" NavigateUri="{Binding FeatureAttachmentUri}" />
     (where FeatureAttachmentUri includes the token param)

Cheers,
Jennifer

[Anonymous User]

Original User: jenniferdnery

Thank you for reporting this. It has been posted at another thread http://forums.arcgis.com/threads/52811-AttachmentEditor-Viewing-attachments-requires-REST-API-login and has been assigned NIM079307. We are currently working on this bug. The AttachmentInfo.Uri need to include FeatureLayer.Token, which it currently does not.

[Anonymous User]

Original User: jmurdoch

While it's true that the token isn't appended to the AttachmentInfo.Uri, I have worked around this by appending the token param to the URI myself.  This allows me to access and download the attachment from my application code. 

BUT, this does not let me open the attachment in the browser using a Silverlight control as above.  This is the issue I'm hoping to have addressed.

Any assistance would be gratefully received!  Thank you!

Cheers,
Jennifer

[JenniferNery]

      <HyperlinkButton Content="{Binding Name}" NavigateUri="{Binding Uri}" 
                                  VerticalAlignment="Center" TargetName="_blank">

When you create AttachmentEditor.Style, the highlighted code above is missing token. The correct Uri should be appended with "<AttachmentInfo.Uri>?token=<FeatureLayer.Token"

[Anonymous User]

Original User: jmurdoch

Sorry for the confusion.  The binding above is not to an ESRI AttachmentInfo object, but to my own business object with a Uri field that is composed of the AttachmentInfo URI appended with the token URL parameter.  When I use this exact business object's URI to request the attachment content from my business logic code, the attachment downloads successfully.  However, attempting to open the attachment in the browser using a Silverlight control fails.

As I said, I believe this is the result of the HTTP referrer used to generate the token not being the same referrer used by the browser to perform the request, and I'm wondering if there is a workaround that would allow me to open the attachment in the browser, rather than building my own document viewer into my Silverlight application.

Cheers,
Jennifer

[JenniferNery]

I just verified that appending FeatureLayer.Token to the attachment URI should be enough.

[Anonymous User]

Original User: ah1508

      <HyperlinkButton Content="{Binding Name}" NavigateUri="{Binding Uri}" 
                                  VerticalAlignment="Center" TargetName="_blank">

When you create AttachmentEditor.Style, the highlighted code above is missing token. The correct Uri should be appended with "<AttachmentInfo.Uri>?token=<FeatureLayer.Token"

Could you go into more detail on how this is done. I think I'm missing a piece of the puzzle. Thanks!