I have a site where I use AngularJS to connect to Services module paths.

Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to user's session id.

My problem is that some users are currently logged into the system for Drupal (I can see all content for authenticated users ) but when I send a PUT request, Drupal return me the error of invalid CSRF token.

So, how can I retrieve a new CSRF token without logout the user ?


2 Answers 2


To get the CSRF Token, do a GET on:


Please note that 'services', is not the path to your endpoint, its a built in path provided by the Services module.

After grabbing the token, you then pass the token along in the header for any POST, PUT, and DELETE requests from authenticated users:


jDrupal may be of use in this scenario as well, it's a JavaScript API for the Drupal Services module


You can also use jdrupal.js to perform number of operation on Drupal site using services module. Add npm install jdrupal. It will directly retrieve a new CSRF token without logout the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.