I am planning to write client apps which connects to Drupal 7. I like to create new users through the app, have come across some literatures but I am not sure if the approach is secure and also whether it considers all possible use-cases.

The first link which I came across is this: https://www.drupal.org/node/1514312

I was able to configure endpoint and successfully post + create user. However, the problem with above approach is, it is not secure because any client app with the POST URL to create user can successfully register a user in the website.

I then followed this link: https://www.drupal.org/node/1871498 through which I created a OAuth authentication context. Below are the configuration details:

OAuth Context:
Context Title: App Name
Signature Method: HMAC-SHA1

The Service configuration:

Endpoint: create_new_user
OAuth Context -> Context created above
Default required authentication -> Consumer key (2 legged OAuth Authentication)
Resources ->
user -> create (Only create in CRUD Operation)
Action ->
user -> request_new_password & register

enter image description here

enter image description here

enter image description here

And I created a new user and provided the following role: enter image description here

By enabling 2 legged OAuth authentication I make sure that only my authorized app with the consumer key and secret is able to access my endpoint successfully.

Using the following POST request I am able to create user successfully from the REST client:

Post Request URL: http://ExampleWebsiteBase.com/create_new_user/user/register.json

Post Headers:

OAuth oauth_version="1.0", oauth_signature_method="HMAC-SHA1", oauth_nonce="kXZ3iOtGqD7f350", oauth_timestamp="1450257992", oauth_consumer_key="Lq7r.........", oauth_signature="htvy........"


Post Body:
   "mail":"[email protected]",

I would need confirmation from experts that this configuration is secure and acceptable.


  • The user created in this process does not has to verify the email ID. How do I configure the webservice so that the user is not created in backend without verifying the email?
  • How do I integrate Social login - Facebook, Twitter and Google for instance?

1 Answer 1


Try using the example reference below which displays the php code using OAUTH library with Services module.

Email verification needs to be done using the rules by adding condition to block user since using oauth it will be activated by default.

You can use the Facebook/Twitter end-point, consumer credentials(key & secret) replaced to Drupal services.

Reference: http://www.covenantdesign.com/blog/drupal-services-rest-server-and-3-legged-oauth

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.