A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that website over REST. To do this, we first have to 'login' to the system, for which we get a session token and id, and then have to get a CSRF token from this same website. To get this token, we have to make a request to the website, giving the token and id we got earlier. After this, we can use the token and id, combined with the CSRF token, to make edit requests.

But why does having to request this CSRF token first make this system any more secure?

1 Answer 1


If you are using the services module and the user login endpoint, when you perform the login trough your app you should receive:

  • sessid
  • session_name
  • token
  • user

(This can be investigated further checking the source code here.)

To make all subsequent calls keeping alive the session you just opened (i.e. as a registered user), you need to send the cookie session value and the csrf token value.

For example:

$ curl http://example.com/app/v1/endpoint --header "Content-type: application/json" --header "Accept: application/json" --header "X-CSRF-Token: X-_xz1fu5eSyHeBPqExAPDg4CdZKlHdiW6Lr7SP3N3Y" --header "Cookie: SESS40c98733719ab6b30c22a4545524a6cc=VWcWeGkTF7xgeMyoQwx5CGPHzIhttUUwmcwq_usiimk"

In theory you shouldn't need to make an extra call just to get the CSRF token, because it is already returned in the first response.

  • Alright, that's useful to know, I missed the token in the first request. However, why do you have to send a CSRF token if you also send your cookie session? What's the added security?
    – Erik S
    Oct 28, 2015 at 9:12
  • An example of the explanation you are looking for can be found here
    – marcoscano
    Oct 28, 2015 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.