Data Access API does not support X-Dataverse-key header

[pdurbin]

http://guides.dataverse.org/en/4.2/api/native-api.html says, "Calls that do require authentication require the user’s API key. That key can be passed either via an extra query parameter, key, as in ENPOINT?key=API_KEY, or via the HTTP header X-Dataverse-key" but I can't get the X-Dataverse-key header to work with the Data Access API.

This works:

curl http://localhost:8080/api/access/datafile/12?key=$API_TOKEN

This doesn't work:

curl -H "X-Dataverse-key:$API_TOKEN" http://localhost:8080/api/access/datafile/12

I believe we want both to work. The header version was introduced in #2123 so that some day we can deprecate the query parameter version.

[pdurbin]

@landreev since you were just in this code for #2648 I'm putting this ticket in your name for now to take a look at least, when you have a chance.

[landreev]

I feel I should fix this in 4.3, since this is kind of a security thing.
And "low hanging enough.

[landreev]

Should be ready for QA.
Please note: I spoke to Gustavo and we decided to push this fix into the branch "2871-batch-downloads-improvements" - the one for the "zip downloads of large batches of files" issue. This is to make life slightly easier, because
a) this was a relatively simple/minor fix; and
b) it affects one of the class files (Access.java) that was also changed for 2871.

Testing:

You can try downloading a restricted file, for example:

wget -O /tmp/test.out http://localhost:8080/api/access/datafile/NNNN

the above should fail with a 403.

Now with the api token, sent in the new header:

wget -O /tmp/out.txt --header "X-Dataverse-key: YOURAPITOKEN" http://localhost:8080/api/access/datafile/NNN

this should work, assuming the supplied token was legit.

[kcondon]

OK, works with both command line and header versions. Closing.