I'm new to the services and rest_server modules (and RESTful APIs altogether.) As I understand it though, the steps are basically this:
- Send a post request to /api/user/login with the username and password set in data
- Store the token you get in the response
- On subsequent post requests, add the token to the header with the key X-CSRF-TOKEN
When I use the Postman Chrome extension to do that, it works great. When I do it in code, it does api/user/login fine, I get the token, but when I try to access /api/other/endpoint, I get 403 Access denied for user anonymous error.
The first request (/user/login) looks like this:
POST /api/user/login HTTP/1.0
Content-Type: application/json
Accept: application/json
User-Agent: Drupal (+http://drupal.org/)
Host: mysiteurl.com
Content-Length: 41
{"username":"NAME","password":"PASSWORD"}
And the second request (/other/endpoint) looks like this:
POST /api/other/endpoint HTTP/1.0
Content-Type: application/json
Accept: application/json
X-CSRF-TOKEN: vGJm5GNDGumf-SoHnLsBU6d46EkrOZkvUY0CSa08GA0
User-Agent: Drupal (+http://drupal.org/)
Host: mysiteurl.com
Content-Length: 0
If I make requests to /user/token after authenticating, I get new tokens each time. If I try to logout immediately after logging in (and send along that token), I get a "406 Not Acceptable : User is not logged in." error. it tells me user is not logged in.
If I check the site though, it shows the user as successfully having logged in, and still being logged in after the fact.
Do I have to save/send anything regarding the session name/id or cookie? Everything I've been looking at suggests only the session token is necessary.
Session authentication
underadmin/structure/services/list/[my-endpoint]
and clear all caches?