I have tried to access node.load and system.connect services, for example, using various clients, and I always get a 403 Forbidden response.

Everything works fine from http://empleos.mentor/admin/build/services/browse/node.load, and to simplify I have removed keys and session id requirements in the settings.

Examples:

Using the execute php block from the devel module:

$ret = xmlrpc('http://subdomain.example.com/services/xmlrpc', 'node.load', 7);
if (xmlrpc_error()) {
$error_num = xmlrpc_errno();
$error = xmlrpc_error();
print_r ($error);
}
print_r($ret);

Am I missing something elemental?

Thanks in advance for your help.

Comments

squaretone’s picture

squaretone commented

Are you using shared hosting? I had the same problem and it turned out to be a security setting of the host. They allowed overridding the setting by adding the following into a .htaccess file:

<IfModule mod_security.c>
SecFilterScanPOST off
</IfModule>
victorkane’s picture

victorkane commented

No, this is on various different development boxes and a shared hosting and they all reply with 403, even with your .htaccess patch.

Thanks a million, anyway!

victorkane’s picture

victorkane commented
Title: accessing xmlrpc server and services with a client » can't get it to work in a variety of environments
Category: support » bug

Some months ago I wrote the article "Transmitting nodes between Drupal sites", where I used Drupal's core xmlrpc features for the purpose (see http://awebfactory.com.ar/node/234).

This is working in all the environments where I am trying to use your more functional and standardized layer over the Drupal core. But I cannot get yours to work, from one Drupal install to another, whether on the same box, same domain or different domains, whether hosted or development box.

Elevating to bug report (no-one has pointed me to an example where xmlrpc is working between sites).

victorkane’s picture

victorkane commented
Title: can't get it to work in a variety of environments » can't get it to work with xmlrpc in a variety of environments

changed title to show that I am talking about xmlrpc

victorkane’s picture

victorkane commented

Bump.

robloach’s picture

robloach
he/him
commented

Did you disable the session keys for the services and open up the permission for anonymous users?

victorkane’s picture

victorkane commented
Status: Active » Fixed

Yeah, thanks Rob, that does the trick. It works now. So this is fixed.

But can you give me an example of how to add some kind of security with this setup? (was hoping to use the user login and session etc.: any suggestions).

In any case, marking as fixed (see my Services for idiots page: http://awebfactory.com.ar/node/297 .

robloach’s picture

robloach
he/him
commented

If you download the latest version of Services, you'll be able to make domain-strict service calls that required you to pass a hashed private key, domain, and timestamp to the service before a request is completed.

victorkane’s picture

victorkane commented

ah, cool, what would the syntax of that be, say, in my simple devel execute php example?

robloach’s picture

robloach
he/him
commented

Simple devel execute? When you make a call to a service the first parameter would be your public key (MD5ed private key, domain and timestamp), the second argument would be the domain, and the third argument would be the timestamp, and then the remaining method arguments.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.