Restws authentication

Question

How can I login to my Drupal in API way and use the rest ws module with API calls?

For example, I have a user with name test. I want to login with test user then use API calls with something like a token or identity (I don't know what) and make Drupal recognize user in :

global $user;

How is it possible?

I tried to post username and password to /user/login path and get token from /restws/session/token

It returns something like this :

emGevPKZl9aLe90tOJ1ZK9rnp--6BMeNV3RP27aqcsY

but when I use it in header parameters with name X-CSRF-Token it does nothing.

Answer 1

You would probably have an easier time using the services module it's better supported and used far more than the restws module. It supports several types of web service calls including RESTful.

SERVICES:

A standardized solution of integrating external applications with Drupal. Service callbacks may be used with multiple interfaces like REST, XMLRPC, JSON, JSON-RPC, SOAP, AMF, etc. This allows a Drupal site to provide web services via multiple interfaces while using the same callback code.

Answer 2

Username

Unless specified in your settings.php as a regex string.. ($conf['restws_basic_auth_user_regex'] = '/^ws_.*/';) restws requires your username to start with restws, so restws_test or something.

Auth

Referencing the conversation https://www.drupal.org/node/1664352

A Drupal site uses it's own authentication - and therefore does not issue an 'HTTP AUTH needed here' type header.

Tools like Poster and wget do not send the HTTP AUTH credentials you've supplied unless the site asks for them - and Drupal doesn't. So because the credentials are not sent the restws_auth_basic module does not have them to use to login in to the Drupal site.

So - for wget - add the '--auth-no-challenge' switch to get wget to sent the credentials anyway. I.e.

$ wget --user=ws_user1 --password=xxxxx --header="Accept: application/xml" --auth-no-challenge -O - http://www.example.com/node/1

Also, curl seems to send the credentials without an extra switch being added - i.e.

$ curl --user ws_user1:xxxxxx --header "Accept: application/xml" http://kbailey.icmsv4.dev3/node/1

Additionally

If your using postman.. I suggest you enable interceptor... this basically means for testing you can log in to your site as usual and this will be stored in session cookies, which interceptor enables accces to. When already logged in, youll find you can post to restws/session/token happily and get the csrf token in response.