Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

VSO REST API - Getting user profile image only works with basic authentication?

I'm using the VSO REST API to get all members in a team, from there I'm getting the ImageUrl of the member.

If I just bind an Image control to ImageUrl it's blank because VSO requires that I be signed in to get a profile picture... so I created a HttpClient and set my Authorization to OAuth and gave it my access token.

This just returns a 403 : Forbidden response... But if I use basic authentication, then everything works fine?

Is basic authentication the only method to get profile images from VSO via the REST API?

like image 642
BeginnerCoder Avatar asked Apr 11 '15 11:04

BeginnerCoder


People also ask

How do you call REST API with basic authentication?

The client must create a POST call and pass the user name, password, and authString in the Request headers using the /x-www-form-urlencoded content type. The AR System server then performs the normal authentication mechanisms to validate the credentials.

Is basic authentication secure FOR REST API?

Basic authentication is an HTTP-based authentication approach and is the simplest way to secure REST APIs. It uses a Base64 format to encode usernames and passwords, both of which are stored in the HTTP header.

How do I authenticate a user in REST Web services?

Use of basic authentication is specified as follows: The string "Basic " is added to the Authorization header of the request. The username and password are combined into a string with the format "username:password", which is then base64 encoded and added to the Authorization header of the request.


1 Answers

Both Basic Auth and OAuth 2.0 are supported by the REST API.

Click through to details on using OAuth 2.0 with the API

UPDATE: Missed an important part of the question. Sorry. :-(

To get a user's image the endpoint is

https://*.visualstudio.com/DefaultCollection/_api/_common/identityImage?id=<Guid>

Unfortunately _api/_common/identityImage is not an allowed route for an app that authenticates with an OAuth access token at the moment, so this is an expected behavior. The team is aware of it, though I don't know where it is in their list of priorities.

Add a suggestion at http://visualstudio.uservoice.com for this so that it makes the request more visible for them.

like image 99
Richard Banks Avatar answered Oct 18 '22 13:10

Richard Banks