How do I construct an authenticated HTTP request in Postman?

Question

I have Drupal 7 installed locally on my computer with the domain set to http://drupal.local.

I am trying to prepare an external script in PHP or Python (or even in pure Bash using curl, if it does not require a lot of extra work), which will successfully execute an HTTP request by default available only for the logged in user.

To understand what such a HTTP request should look like, I am first trying to perform such a HTTP request using Postman, but all my attempts failed.

This is what I've done so far:

1. In the browser, I logged in as administrator of the Drupal 7 site
2. I opened the browser on http://drupal.local/en/node/add/article and I received status 200 (The page is displayed correctly in my browser.)
3. In Postman I set:
   • request method on: GET
   • URL: http://drupal.local/en/node/add/article
   • Headers: I set all headers identically to those in the browser including the current cookies containing the session key with its value
4. I don't have access to this page and I receive a 403 error

How do I construct an authenticated HTTP request in Postman that will work for Drupal 7?

Answer 1

You can make use of Token authentication but be careful:

From module description:

Be careful with what paths you expose to Token Authentication, as it is effectively a very simple, very low security password mechanism. You can expose Administration pages through bad configuration.

1. Install / enable Token authentication Module.
2. Go to admin/config/services/tokenauth
3. Add the path you want to give access to with token. in the example below i added all add content pages.
4. Go to admin/people edit the user you want to generate token.
5. Generate Token by clicking on Token authentication tab it will give a token for that user like ?token=tuvj7cMwauxStWGVQYfo.
6. Then you can use it with postman.

Note: it may not be the best way.