POST: 403 error in REST

Question

I created a custom entity, next I enabled (via RESTui) the GET and POST methods. I gave anonymous users permissions to "Access GET", "Access POST" and "Create new content" of that entity.

When I navigate in my browser to "http://mywebsite/my_entity/1?_format=json", I get a proper JSON response. When I navigate to "http://mywebsite/my_entity/add", I can add a new entity.

When I try to POST a new entity via "http://mywebsite/my_entity?_format=json", I get a 403 repsonse with following body:

{ "message": "" }

Does someone have an idea what I'm missing here?

EDIT: When i put a die('give me something') in the method post() of the class "EntityResource" (which is the base class for all entities), the message isn't displayed...

EDIT2: I added headers "Content-Type" and "X-CSRF-Token"

Answer 1

Do you provide a (Basic) authorization header, as well as a X-CSRF-Token header in your POST?

See also: https://www.drupal.org/documentation/modules/rest/start - "2.2 Unsafe methods & CSRF protection: X-CSRF-Token request header"

Edit: So you should at least specify the following HTTP headers:

• Content-type: application/json
• X-CSRF-Token: [TOKEN RETURNED FROM A REQUEST TO /rest/session/token]