I'm building decoupled drupal site. I need to be able to authenticate REST client via session ID passed in a URL (or maybe custom header) instead of a cookie.

At first I thought about implementing my own AuthenticationProviderInterface that would work pretty much the same as Drupal\user\Authentication\Provider\Cookie does, but when I looked into the Cookie class itself I thought that I should rather play with session object and "teach" it how to read session id from alternative source instead of reading it from a cookie.

How can I do that?

Should I swap session_configuration (which directly accesses Request::cookies) or maybe session service? Do I need to swap them at all?

The crucial part is that I don't want to loose standard cookie authentication. I just want to be able to authenticate with session ID when there is no session cookie.

  • What is the reason you don't want to use cookies, it might help to give you an answer. Apr 21, 2016 at 14:35
  • Interesting question. I found gist.github.com/manjeshpv/79d0540a97427796cc52 using PHPSESSID transforming it into $_COOKIE .. can the web server do this instead of Drupal? Apr 21, 2016 at 15:03
  • @longboardnode this is for a REST service. Using cookies with REST calls is really not very convenient. Apr 21, 2016 at 15:39
  • @ClemensTolboom interesting hack, though it would require me to plug into request stack before session service. And it's a bit awkward because session service provides session cookie name. Circular dependency unless I'll reproduce session service code to get cookie name. This starts to sound really bad. Apr 21, 2016 at 15:46
  • @SiliconMind is your REST Client on a single IP so you can auth against the IP address and perhaps some token with each request? Apr 21, 2016 at 18:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.