# RESTful ws - access the current authenticated user

**URL:** <https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832>\
**Category:** Classic Servoy\
**Created:** [September 8, 2010, 11:31am UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832 "2010-09-08T11:31:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![udrescu\_bogdan](https://avatars.discourse-cdn.com/v4/letter/u/87869e/32.png) [@udrescu\_bogdan](https://forum.servoy.com/u/udrescu_bogdan)\
**Post date:** [September 8, 2010, 11:31am UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832/1 "2010-09-08T11:31:32Z")

</div>

Hello,

I’ve implemented the new authentication mechanism for my RESTful service (http basic authentication).

I need to know in my RESTful methods who is the authenticated user each time the method is called - the user that is sent in the HTTP Authorization parameter and validated by servoy engine (I think). I tried to get the username/UUID from the security ( **security.getUserUID()** ), but it returns nothing.

Thank you,  
Bogdan.

---

<div class="post-metadata">

**Author:** ![tgs](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@tgs](https://forum.servoy.com/u/tgs)\
**Post date:** [September 8, 2010, 3:42pm UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832/2 "2010-09-08T15:42:33Z")

</div>

Hi Bogdan,

have you read the Servoy Wiki for that?

[http://wiki.servoy.com/display/public/DOCS/Upgrade+existing+implementations+to+Servoy+5.2's+Enhanced+Security](http://wiki.servoy.com/display/public/DOCS/Upgrade+existing+implementations+to+Servoy+5.2%27s+Enhanced+Security)

---

<div class="post-metadata">

**Author:** ![sbutler](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/sbutler/32/4393_2.png) [@sbutler](https://forum.servoy.com/u/sbutler)\
**Post date:** [September 8, 2010, 8:29pm UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832/3 "2010-09-08T20:29:37Z")

</div>

The way the restful webservices plugin is implemented, you can’t really implement authentication and get back the Servoy user id (at least not reliably). When you make a call to the webservice you can’t expect to always be using the same client since the rest\_ws plugin uses a pool of clients. The HTTP Auth option on the updated restful webservices plugin should only be used to restrict access to the web service. It should not be used for session info (like to get users id was used on the HTTP Auth) because that goes against the idea of a “Restful” web service. (although I agree it would be nice to be able to get that info)

If you want a statefull web service, where each client gets its own headless client on the server and can save session based info (and add table filters, etc), I can send you a demo of the web services plugin that we use.

The other option would be to request a new feature to support user/tenant filtering in the rest\_ws plugin, but in proper restful format. So for example, instead of:

```auto
http://<serverUrl>/servoy-service/rest_ws/solutionName/formName

```

You would need an option like:

```auto
http://<serverUrl>/servoy-service/rest_ws/USERNAME/solutionName/formName

```

and then combine that with the http auth so that it restricts the authentication to only that USERNAME in the url. That would follow proper restful format, and would work better with the plugin since the USERNAME is being passed in the URL, so you can still do client pooling. The trick is to combine that with the HTTP Auth so that it restricts auth to that URL based on the USERNAME specified.

---

<div class="post-metadata">

**Author:** ![Lachness](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@Lachness](https://forum.servoy.com/u/Lachness)\
**Post date:** [March 13, 2011, 7:54pm UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832/4 "2011-03-13T19:54:36Z")

</div>

Hello,

**http:///servoy-service/rest\_ws/USERNAME/solutionName/formName**

Has anyone requested this addition to the webservice solution provided by Servoy?

I don’t plan to use session info with the username/UID. But it would be a convenient way to tie information to the user.

These calls would be done in every webservice method.

```auto
function ws_read(id) {

    if (id) {
        var userName = security.getRestUserName()
        var userInfo = myMethodGetInfo(userName)
        .......
        .......
      }
}

```

---

<div class="post-metadata">

**Author:** ![ptalbot](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/ptalbot/32/4952_2.png) [@ptalbot](https://forum.servoy.com/u/ptalbot)\
**Post date:** [March 13, 2011, 10:36pm UTC](https://forum.servoy.com/t/restful-ws-access-the-current-authenticated-user/12832/5 "2011-03-13T22:36:58Z")

</div>

Passing anything other than session IDs in a URL is a security breach.  
Nothing would prevent anyone to “pretend” he is another user if you did it this way.