title: What are the correct steps for POST authentication to a Neo4J server?
body: <p>I am trying to connect to a Neo4J sandbox, and can connect fine in the online browser. However, I'm now trying to connect via a small app. The first step is to authenticate, and no matter what I try I get '401/Unauthorized'. So far as I can tell, I am following the steps in the <a href="http://neo4j.com/docs/2.2.0-M02/rest-api-security.html" rel="nofollow">"Authorization tokens" documentation</a>.</p>
  
  <p>With a plain HTTP connection, I am POST-ing:</p>
  
  <ul>
  <li>to <code>/authentication</code></li>
  <li>Content-Type: <code>application/json</code></li>
  <li>Accept: <code>application/json; charset=UTF-8</code></li>
  <li>Accept-Charset: <code>UTF-8</code></li>
  </ul>
  
  <p>The payload is a JSON string: <code>{ "username" : "neo4j", "password" : "MYPASSWORD" }</code></p>
  
  <p>This is the same username and password I used to log on to the sandbox in my web browser. I have also tried setting the connection request username and password to the same values. Note there is no authentication-request response.</p>
  
  <p>The full log of traffic is:</p>
  
  <pre><code>Send:
  POST /authentication HTTP/1.0
  Connection: keep-alive
  Content-Type: application/json
  Content-Length: 91
  Host: ec2-52-23-247-121.compute-1.amazonaws.com:32780
  Accept: application/json; charset=UTF-8
  Accept-Charset: UTF-8
  Accept-Encoding: identity
  User-Agent: Mozilla/3.0 (compatible; Indy Library)
  
  Send:
  %7B+%22username%22+%3A+%22neo4j%22%2C+%22password%22+%3A+%22MYPASSWORD%22+%7D
  Receive:
  HTTP/1.1 401 Unauthorized
  Date: Thu, 03 Dec 2015 20:50:11 GMT
  Content-Type: application/json; charset=UTF-8
  WWW-Authenticate: None
  Content-Length: 139
  Connection: keep-alive
  Server: Jetty(9.2.4.v20141103)
  
  {
    "errors" : [ {
      "code" : "Neo.ClientError.Security.AuthorizationFailed",
      "message" : "No authorization header supplied."
    } ]
  }
  </code></pre>
  
  <p>Note I have redacted my actual password in the above log.</p>
  
  <p>Should the sent data have been encoded, as it has been? ('<code>%7B+%22username%22+...</code>'?) That's an automatic behaviour of the HTTP library I'm using, and I'm not familiar enough with HTTP traffic to know if it's correct or not.</p>
  
  <p>So - "No authorization header supplied" seems a good hint, but the documentation does not ask for an authorization header, but says to send the username and password in JSON as the payload. Also, when I do set the request username and password, I never see the traffic communicate that.</p>
  
  <p>I'm using Delphi's Indy library to communicate. The setup is very simple:a button to connection, a memo to log to, a <code>TIdHTTP</code> component on the form, and a <code>TIdLogStream</code> component to intercept the traffic (that's where the above log comes from.) All settings are defaults, except that <code>IdHTTP1.Intercept</code> is set to <code>IdLogStream1</code>.</p>
  
  <p>The connection method is:</p>
  
  <pre><code>procedure TForm1.btnConnectClick(Sender: TObject);
  var
    ParamList: TStringList;
    Res : string;
  begin
    ParamList := TStringList.Create;
    try
      try
        IdHTTP1.Request.Accept := 'application/json; charset=UTF-8';
        IdHTTP1.Request.AcceptCharSet := 'UTF-8';
        IdHTTP1.Request.ContentType := 'application/json';
  
        ParamList.Add('{ "username" : "neo4j", "password" : "MYPASSWORD" }');
        IdHTTP1.Request.Username := 'neo4j';
        IdHTTP1.Request.Password := 'MYPASSWORD';
  
        Res := IdHTTP1.Post('http://ec2-52-23-247-121.compute-1.amazonaws.com:32780/authentication', ParamList);
  
        memData.Lines.Add(Res);
      except
        on E : Exception do
          memData.Lines.Add('Exception: ' + E.ToString);
      end;
    finally
      ParamList.Free;
    end;
  end;
  </code></pre>
  
  <p>So far as I can tell, this should follow the <a href="http://neo4j.com/docs/2.2.0-M02/rest-api-security.html#rest-api-authenticate-to-obtain-an-authorization-token" rel="nofollow">"Authenticate to obtain an authentication token" documentation</a>. But obviously not. What am I doing wrong?</p>
  
  <p>Ideally, it would be nice to have a complete set of steps for POST authentication. Authentication is a common problem in other questions here, and no solutions to those have helped me. A definitive answer of all connection steps and responses would be of great help to those who come after this question too.</p>
  
  <p><strong>Edit:</strong> this is Neo4J 2.3.1. It's a sandbox made via the <a href="http://neo4j.com/sandbox/" rel="nofollow">Neo4J Getting Started -> Sandbox</a> page earlier today.</p>