Re: [ovirt-devel] UI plugins - talking with Engine via JSESSIONID now requires separate request header

----- Original Message ----- My understanding is that REST API's session management feature is something on top of (stateless) REST / HTTP concept, so I'd say that "stateless" approach (sending user credentials with each request, without using any session) should always be supported. It just affects UI plugins deployed on Engine 3.5 or later, which are talking to Engine via session ID provided by "RestApiSessionAcquired" hook. None of the above :) In general, when you ask REST API to create session ("Prefer: persistent-auth" header), you can also tell the preference whether you want to CSRF-protect it ("Prefer: csrf-protection") or not. If a REST API session is marked as CSRF-protected, in addition to sending JSESSIONID cookie, you must also send JSESSIONID _header_ with same value. (WebAdmin UI plugin infra acquires CSRF-protected REST API session for all UI plugins.)