I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated forever. Is it possible?

Here is the workflow i am following.

First launch of app

  1. POST /services/session/token to retrieve CSRF Token
  2. POST myendpoint/system/connect with X-CSRF-Token header
  3. IF not Logged In Try Log in /myendpoint/user/login
  4. Log in Success and keep session_name=sessionid in Cookie Varible

Future Launches

  1. POST /services/session/token to retrieve CSRF Token
  2. POST myendpoint/system/connect with X-CSRF-Token header along with previousely saved session_name=sessionid as Cookie Header

From this point I am getting ["CSRF validation failed"] message. Am I missing something? Is the workflow correct?


Evidently the workflow has been simplified. I make a single call to /user/login. Here is an example:

  "method": "POST",
  "url": "http://HOSTNAME/SERVICE_PATH/user/login",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive"
  "json": {
    "username": "USERNAME",
    "password": "PASSWORD"

which returns:

Response: {
  "sessid": "waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I",
  "session_name": "SESSb4d5ba755bb4eb727d982993490e6681",
  "token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",

Now the cookie is created by concating the session_name and sessid with the equal sign separating them. The X-CSRF-Token header is simply the token in the response. All future requests will reuse the X-CSRF-Token: and Cookie: headers:

Here is an example of a user profile request:

  "method": "POST",
  "url": "http://http://HOSTNAME/SERVICE_PATH/user/profile",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive",
    "X-CSRF-Token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
    "Cookie": "SESSb4d5ba755bb4eb727d982993490e6681=waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I"

Short answer: call /user/login once, set and reuse the X-CSRF-Token: and Cookie: headers for all future REST calls.

  • 1
    Thank you for posting this! Virtually every piece of documentation available is out of date and doesn't reflect this. – Jon G - Megaphone Tech Feb 6 '18 at 8:24
  • I almost never use Drupal, and this information was so difficult to come by, that I sought out this question just to share. Glad it helped and I have no idea if it remains relevant. – Shannon Haworth May 17 '19 at 16:24

Don't request for new CSRF token use the returned one for previous request.

You will find it in a key named token in the result returned.

Just request a new csrfCSRF token for the first time only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.