Getting 403 Forbidden response with REST API on CE 1.9.1.0

Question

I'm using this link as my model for testing the REST API, and I get all the way through the authorize prompt to a "403 Forbidden" response (this is for both the customer and admin examples).

Invalid auth/bad request (got a 403, expected HTTP/1.1 20X or a redirect)
{"messages":{"error":[{"code":403,"message":"Access denied"}]}}

STEP 1 - I access this example URL: http://mywebsite.net/oauth_admin.php

STEP 2 - I see the login prompt and log in, along with seeing the token in the URL: http://mywebsite.net/admin/oauth_authorize?oauth_token=a35aa73f8bda2fce1d5d4db25628129d

STEP 3 - I get the desired authorize prompt:

STEP 4 - I click authorize and I get the above 403 response.

I have setup the REST user and role as according to the instructions at the above link, and believe I have followed all other steps - multiple times. I'm at a loss as to why this fails.

Has anyone else experienced this issue? I've also tried using the Firefox and Chrome API extensions with the same result.

UPDATE: I found that someone else solved this issue when the request was passed over HTTPS. There is nothing in the tutorials mentioning a prereq SSL. Has anyone else successfully used REST without SSL? See their solution here--> Why do I get unauthorized for REST API

Answer 1

I can give you workable example:

System / Web Services / REST Roles

    Role info: 
Role Name: admin
Password: 123123
    Role API resources:
Resources access: All
    Role Users:
I have assigned admin user

System / Web Services / REST Attributes / Select {Admin}

Resources access: All

System / Web Services / REST OAuth Consumers

My magento url is http://mg1910.local.dev/

My http://mg1910.local.dev/oauth_admin.php is following:

<?php

/* live server */
$host = 'http://mg1910com.local.dev/';
$consumerKey    = '7e14cd85d05456c3e4de9e3c5c5f61e4';
$consumerSecret = 'f8aab713fa50504f0fac99d564ecaf7a';
/* << live server */


$callbackUrl = "http://mg1910com.local.dev/oauth_admin.php";
$temporaryCredentialsRequestUrl = $host . "oauth/initiate?oauth_callback=" . urlencode($callbackUrl);
$adminAuthorizationUrl = $host . "admin/oauth_authorize";
$accessTokenRequestUrl = $host . "oauth/token";
$apiUrl = $host . "api/rest";

session_start();
if (!isset($_GET['oauth_token']) && isset($_SESSION['state']) && $_SESSION['state'] == 1) {
    $_SESSION['state'] = 0;
}
try {
    $authType = ($_SESSION['state'] == 2) ? OAUTH_AUTH_TYPE_AUTHORIZATION : OAUTH_AUTH_TYPE_URI;
    $oauthClient = new OAuth($consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1, $authType);
    $oauthClient->enableDebug();

    if (!isset($_GET['oauth_token']) && !$_SESSION['state']) {
        $requestToken = $oauthClient->getRequestToken($temporaryCredentialsRequestUrl);
        $_SESSION['secret'] = $requestToken['oauth_token_secret'];
        $_SESSION['state'] = 1;
        header('Location: ' . $adminAuthorizationUrl . '?oauth_token=' . $requestToken['oauth_token']);
        exit;
    } else if ($_SESSION['state'] == 1) {
        $oauthClient->setToken($_GET['oauth_token'], $_SESSION['secret']);
        $accessToken = $oauthClient->getAccessToken($accessTokenRequestUrl);
        $_SESSION['state'] = 2;
        $_SESSION['token'] = $accessToken['oauth_token'];
        $_SESSION['secret'] = $accessToken['oauth_token_secret'];
        header('Location: ' . $callbackUrl);
        exit;
    } else {
        $oauthClient->setToken($_SESSION['token'], $_SESSION['secret']);
        $resourceUrl = "$apiUrl/products?limit=3";
        //$oauthClient->fetch($resourceUrl, array(), 'GET', array('Content-Type' => 'application/json'));
        $oauthClient->fetch($resourceUrl, array(), 'GET', array('Content-Type' => 'application/xml', 'Accept' => '*/*'));
        $productsList = json_decode($oauthClient->getLastResponse());
        echo "<pre>";
        print_r($productsList);
    }
} catch (OAuthException $e) {
    print_r($e->getMessage());
    echo "<br/>";
    print_r($e->lastResponse);
}

As you can see my script receive 3 products.

Answer 2

It seems like your server's "apache_request_headers" is disabled.

So, there are one of the two probable solutions:

1. Contact your host and ask them to enable "apache_request_headers".
2. Modify the getHeader($header) function in Zend_Controller_Request_Http class

Replace:

$temp = 'HTTP_' . strtoupper(str_replace('-', '_', $header));

With:

$temp = ($header == 'Authorization') ? $header : 'HTTP_' . strtoupper(str_replace('-', '_', $header));