Why does my API call return a 401 from an Ionic app but not Postman?

Question

I followed the guidance at Smart of the Home to produce the following code in a provider for an Ionic 2 App.

return new Promise(resolve => {
  // We're using Angular HTTP provider to request the data,
  // then on the response, it'll map the JSON data to a parsed JS object.
  // Next, we process the data and resolve the promise with the new data.
  let headers = new Headers();
  headers.append('Content-Type','application/vnd.alertme.zoo-6.1+json');
  headers.append('Accept','application/vnd.alertme.zoo-6.1+json');
  headers.append('X-Omnia-Client','Hive Web Dashboard');
  let options = new RequestOptions({ headers: headers });
  const body = JSON.stringify({
    "sessions": [{
      "username": "<username>",
      "password": "<password>",
      "caller": "WEB"
    }]
  });
  this.http.post('https://api.prod.bgchprod.info:443/omnia/auth/sessions', body, options)
    .map(res => res.json())
    .subscribe(data => {
      console.log(data)
    });
});

Now when I try the Postman collection very kindly provided by the author of the tutorial I linked above, the call returns perfectly fine, but returns a 401 when fired through the app.

Inspecting the requests made, everything appears identical. I cannot fathom what is going wrong?

score 1 · Answer 1 · answered May 13 '17 at 22:30

1

401 means Unauthorized so the author most likely explicitly whitelisted Postman by user agent, IP or a similar mechanism, thus failing your self-hosted app.

answered May 13 '17 at 22:30

Niels Keurentjes

41,402
9
98
136

1

Alas this was not the case. The answer was far simpler. Note the 'sessions' in the guide, not 'session' - two different endpoints... I am going to leave this up though, as a mark of shame. – anthonyhumphreys May 13 '17 at 22:33
Ghe, yeah that was another option hehe. I didn't mention it because a different endpoint would most likely return 404 instead of 401. – Niels Keurentjes May 13 '17 at 22:40
Yeah it seemed too obvious an answer haha - i looked at every a dozen times and swore it was identical. /session i guess probably is GET only and returns the logged in user obj. Ah well! – anthonyhumphreys May 13 '17 at 23:13

score 0 · Answer 2 · answered May 13 '17 at 22:35

To anyone unfortunate enough to stumble unto these parts:

Check your code. Check it. Check it again. One last time. Run it through a diff. If something is doing two different things in two different places but looks identical, Occam's Razor would say the solution is that the code is NOT in fact identical and that you are merely succumbing to a lack of sleep and overindulgence in caffeine.

The answer here is simple. Consider 'auth/sessions' in the tutorial vs 'auth/session' in my code. Two different endpoints.

Why does my API call return a 401 from an Ionic app but not Postman?

2 Answers2