403 Forbidden when creating a page with RESTful API

Question

Referencing this tutorial, I am trying to create a page with RESTful API:

{
  "_links":{
    "type":{
      "href":"http://www.example.com/drupal/rest/type/node/page"
    }
  },
  "title":[
      {
        "value":"My first page"
      }
    ]
}

The POST request is: http://203.80.250.46/drupal/entity/node

The POST request headers are:

• Content-Type: application/hal+json
• PHP_AUTH_USER: (admin_username)
• PHP_AUTH_PW: (admin_password)

But Drupal responded with: 403 Forbidden (Access Denied in response HTML)

Drupal 8 is installed at: http://www.example.com/drupal/

Enabled: HAL, HTTP Basic Authentication, RESTful Web Services, Serialization, REST UI

What did I miss?

Answer 1

The tutorial example using Dev Client is probably what is throwing you off because PHP_AUTH_USER and PHP_AUTH_PW are not valid request headers for Drupal 8 REST. The tutorial does give a curl command using the --user parameter which should do the correct behavior - add an Authorization header. I demonstrated this by manually adding that request header in User login REST format.

Content-Type: application/hal+json
Accept: application/hal+json
Authorization: Basic admin_username:admin_password

Answer 2

Had the same problem and solved it in Drupal 8.6.1 (using Postman for testing):

1. Must use in the POST command the url like http://website.com/entity/node?_format=hal_json

2. make sure you enabled HAL and HTTP Basic Authentication, then in the Configuration REST, Enable Content rest for POS hal_json and Basic Authentication

3. Don't know if help but made the suggested feature in Getting a 403 error in REST & 8.2.3 has no permission set for REST for GET of content

4. put Headers:

Authorization: Basic ....
Content-Type:application/hal+json

5. the Body raw looks like:

{
  "_links": {
    "type": {
      "href": "http://website.com/rest/type/node/article"
    }
  },
  "title":[{"value":"test article55"}],
   "body": [{"value":"test body"}]
}

Answer 3

out of the tutorial

You should create also a new authenticated user for testing purposes. If you test your API with User 0 administrator account credentials, you will likely miss permission settings that you need to be set.

have you set permissions ?? try to create a new role with one user and make sure to give the according permissions from your content type.

Answer 4

I know this question is already old but I found it while diving into a quite similar situation. In your case it could be the lack of a X-CSRF Token header which is important. As indicated in the tutorial, you must visit http://www.example.com/drupal/rest/session/token and use the returned string as value for your X-CSRF-Token header key along with your authentication credentials.

Answer 5

If you're getting an HTML response in spite of specifying Accept: application/hal+json, it may mean that your server is blocking the request and not even sending it to Drupal. Check your Drupal's recent log reports to see if there's any error. If there is no mention of any access denied or similar errors, then you'll probably find the error in the Apache (or any other webserver) logs.

In my case, support for PATCH and DELETE had to be explicitly enabled by putting the following in my Drupal root .htaccess file:

<IfModule mod_headers.c>
  Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE"
</IfModule>

<Limit GET POST PUT DELETE HEAD OPTIONS PATCH>
  Order allow,deny
  Allow from all
</Limit>

The error I got in my Apache log was this:

AH01797: client denied by server configuration:

It does seem slightly odd for POST to be disabled, but this should put you on the right track to figuring out what's going wrong.