Not able to post comment anonymously: getting 403 error

Question

I am working on phonegap app and using drupal 7 as backend for all json request data. I am using the service module for it. At frontend I am using Angular js in phonegap.

I referred http:// drupal.stackexchange.com/questions/22277/creating-comments-and-nodes-with-services-3-x-and-json for posting comment.

I set permission for anonymous user to post comment to any node from drupal permission section. But its not posting any comment. Giving me error.

/appapi/comment.json 403: Access denied for user anonymous

Here is my code:

var dataObj = {"subject":$comment.text, "comment_body":{"und":[{"value":$comment.text}]}, "nid":$comment.nid} ; 

var res = $http.post($scope.apiBaseUrl+'/appapi/comment.json', dataObj,{ withCredentials: false, headers: { 'Content-Type': 'application/json'} }); res.success(function(data, status, headers, config) 
{ //$scope.message = data; 
console.log(data); 
 });

Here is CROS module setting:

*|*|POST,GET,PUT,DELETE|Origin, X-Requested-With, Content-Type, Accept|false

I am sending comment post request from phonegap app. I am not using the AgularJS module.

Answer 1

Thanks tyler.frankenstein. Thanks for suggesting angular-drupal. I integrated it with my agularjs ui and its working superb.

I gone through angular-drupal code and found that it need X-CSRF-Token in header for write operation. Accordingly i modified my CORS setting

*|*|POST,GET,PUT,DELETE|Origin, X-Requested-With, X-CSRF-Token, Content-Type, Accept|false

And used agular-drupal method to save comment. Here is my code.

//register drupal service as provider/injector
.factory('$drupal',['drupal', function(drupal) {
  return drupal;
}])
.
.
.
//inside controller

.controller('HomeCtrl', function($scope, $stateParams,$http,$state,$drupal) {


  $drupal.node_load(27).then(function(node) {
    console.log(node.title);
    alert(node.title);
  });

  var comment = {
  nid: 27,
  subject: 'Hello world',
  comment_body: { und: [ { value: 'How are you?' } ] }
};
$drupal.comment_save(comment).then(function(data) {
    alert('Created comment: ' + data.cid);
});

Other way to achieve this without angular-drupal is to generate x-csrf-token using get request "/?q=services/session/token" and then set it in header for your post request.

Thank you.