5

The Drupal 8 REST UI configuration page asks me to select Authentication providers for GET method; otherwise, it doesn't allow me to export the REST request.

How can I provide anonymous user to access my REST GET API without providing any auth information?

  • 1
    That is done through People -> Permissions, but you most likely have to pick at least one authentication provider. I recommend cookie. – tyler.frankenstein Jan 5 '16 at 0:53
  • 1
    @tyler.frankenstein, as for Drupal 8.4, seems that no permissions available to be set there. – W.M. Oct 11 '17 at 12:50
4

You could create your own authentication provider; it could then allow anonymous users access to your resource. It is not that difficult, the only thing I found is that you have to be careful to make sure the authentication provider only applies whe you specifically want it to. Look here for a tutorial:

http://enzolutions.com/articles/2014/12/28/how-to-create-an-authentication-provider-in-drupal-8/

  • Again, simple thing made complicated. Why anonymous users are denied access by default in the first place. I won't run Drupal 8 ever, I just installed it to benchmark its RestFUL API against other frameworks. A benchmark, Drupal 8 surely will lose. – W.M. Oct 11 '17 at 12:52
  • Just ran the benchmark: Drupal 8 = 75 requests/second vs. another new framework (not PHP based) = 550 requests/second. Amazing. There will be no Drupal 9. – W.M. Oct 11 '17 at 13:02
  • @W.M. Because maybe you don't want to allow anonymous users to get access to the endpoints, this is normal, some endpoints return information that should not be public. – Adrian Cid Almaguer Oct 18 '18 at 15:01
2

According to the Drupal documentation : https://www.drupal.org/developing/api/8/rest

Don't forget to grant the corresponding permission! In case of a decoupled site, you typically need to grant the authenticated user role permission to GET content. In case of a web service, you typically need to grant the anonymous users permission to GET/POST content. Grant them at /admin/people/permissions#module-rest, or using Drush: drush role-add-perm anonymous 'restful ', for example: drush role-add-perm anonymous 'restful get entity:node'

basically add the anonymous permission for the GET resource.

  • Does not work in Drupal 8.4 – W.M. Oct 11 '17 at 12:53
  • I can confirm this works in 8.5 – Will Aug 29 '18 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.