Enable token acquisition through an HTTP GET request

Note:

This topic only applies to 10.3.1 and later releases. At 10.3, you could not enable token acquisition through an HTTP GET request. If your organization uses 10.3 and relies on acquiring a token through a GET request, you'll need to upgrade to 10.3.1 or a later release. In 10.2.2 and earlier versions of ArcGIS for Server, acquiring a token through an HTTP GET request was enabled by default.

When using ArcGIS for Server token-based authentication, acquiring an ArcGIS token is only allowed through an HTTP POST request. Acquiring a token through an HTTP GET request (or HTTP POST request with credentials in the query parameter) is possible, but disabled by default. If your organization uses applications that rely on acquiring a token in this manner, follow the steps below to enable token acquisition through an HTTP GET request.

Caution:

Although using a GET request is a convenient method of acquiring a token, a user's credentials are provided as part of the URL and may be stored in browser history or in network components. It's recommended that you update your applications so that tokens are not acquired through a GET request.

1. Log in to the ArcGIS for Server Administrator Directory. The URL is formatted http://gisserver.domain.com:6080/arcgis/admin.
2. Click security > tokens > update.
3. In the Token Manager Configuration dialog box, update the following properties. If necessary, add the properties manually.
   • To acquire a token through an HTTP GET request, set the allowHttpGet property to true.
   • To acquire a token through an HTTP POST request with credentials in the query parameter, set the allowHttpPostQueryParams property to true.

   For example:

   {
       "type": "BUILTIN",
       "properties": {
           "allowHttpGet": "true",
           "allowHttpPostQueryParams": "true",
           "longTimeout": "1440",
           "sharedKey": "VYHyatfGUlFWHgnAVMEc40nL1rn7s+l190vtgMjCx3c=",
           "shortTimeout": "60"
       }
   }

4. Click Update.