I have created a custom services API to save order records in database. I have checked on POSTMAN and it is working fine. But when i request from apps it gives me "CSRF validation failed" issue.

Am i missing something?

  • 1
    Are you using any authentication like session authentication or HTTP basic authentication ? Feb 10, 2016 at 8:14
  • yes i am using session authentication.
    Feb 10, 2016 at 8:23

2 Answers 2


In the POSTMAN you must be sending X-CSRF-Token with the API call, while you might be missing the same while doing API call from APP. X-CSRF-Token is required when you have session authentication enabled, for a quick test disable session authentication from your service configuration page at drupal admin end and then try doing the API call.

However the proper fix would be to have another API in place which gives you X-CSRF-Token and then do your API call along with X-CSRF-Token.

  • Thanks arpitr, i have disabled the session authentication and my problem is solved. Do you have any idea how to send X-CSRF-Token. Drupal generated api (ex:node api) does not show this type of validation error.
    Feb 10, 2016 at 8:40

You can check workflow steps

First Time for login

  • POST /services/session/token to retrieve CSRF Token POST
  • myendpoint/system/connect with X-CSRF-Token header IF not Logged In
  • Try Log in /myendpoint/user/login Log in Success and keep
  • session_name=sessionid in Cookie Varible

Future Launches

  • POST /services/session/token to retrieve CSRF Token
  • POST myendpoint/system/connect with X-CSRF-Token header along with previousely saved session_name=sessionid as Cookie Header

Don't request for new CSRF token use the returned one for previous request. You will find it in a key named token in the result returned. Just request a new csrfCSRF token for the first time only.

Here is an example of a user profile request:

  "method": "POST",
  "url": "http://HOSTNAME/SERVICE_PATH/user/profile",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive",
    "X-CSRF-Token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
    "Cookie": "SESSb4d5ba755bb4eb727d982993490e6681=waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.