Services 3 Session authentication CSRF Validation with Persistent Log in

Question

I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated forever. Is it possible?

Here is the workflow i am following.

First launch of app

1. POST /services/session/token to retrieve CSRF Token
2. POST myendpoint/system/connect with X-CSRF-Token header
3. IF not Logged In Try Log in /myendpoint/user/login
4. Log in Success and keep session_name=sessionid in Cookie Varible

Future Launches

1. POST /services/session/token to retrieve CSRF Token
2. POST myendpoint/system/connect with X-CSRF-Token header along with previousely saved session_name=sessionid as Cookie Header

From this point I am getting ["CSRF validation failed"] message. Am I missing something? Is the workflow correct?

Answer 1

Evidently the workflow has been simplified. I make a single call to /user/login. Here is an example:

{
  "method": "POST",
  "url": "http://HOSTNAME/SERVICE_PATH/user/login",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive"
  },
  "json": {
    "username": "USERNAME",
    "password": "PASSWORD"
  }
}

which returns:

Response: {
  "sessid": "waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I",
  "session_name": "SESSb4d5ba755bb4eb727d982993490e6681",
  "token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
...
}

Now the cookie is created by concating the session_name and sessid with the equal sign separating them. The X-CSRF-Token header is simply the token in the response. All future requests will reuse the X-CSRF-Token: and Cookie: headers:

Here is an example of a user profile request:

{
  "method": "POST",
  "url": "http://http://HOSTNAME/SERVICE_PATH/user/profile",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive",
    "X-CSRF-Token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
    "Cookie": "SESSb4d5ba755bb4eb727d982993490e6681=waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I"
  }
}

Short answer: call /user/login once, set and reuse the X-CSRF-Token: and Cookie: headers for all future REST calls.

Answer 2

Don't request for new CSRF token use the returned one for previous request.

You will find it in a key named token in the result returned.

Just request a new csrfCSRF token for the first time only.