I am stuck for hours now with a JSON REST problem:

I have a simple REST endpoint in my Drupal 8 App. If I call it with the DHC Chromium REST Extension like GET http://proreos/api/v1/checklawyer/1?_format=json, I get - - [07/Jul/2016:15:03:54 +0200] "GET /api/v1/checklawyer/1?_format=json HTTP/1.1" 200 477 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/51.0.2704.79 Chrome/51.0.2704.79 Safari/537.36"

That's wonderful. Also Drupal does all the requested processing. But if I call it from curl like

curl 'http://proreos/api/v1/checklawyer/1?_format=json'

I get the bad 403 response: - - [07/Jul/2016:15:10:27 +0200] "GET /api/v1/checklawyer/1?_format=json HTTP/1.1" 403 409 "-" "curl/7.35.0"

Well actually, I want to call it from a JS plugin like:

function checkLawyer() {
  var server = drupalSettings.bootasde.proreos_server;
  var id = drupalSettings.bootasde.asdeid;
  var jUrl = server+'api/v1/checklawyer/'+id+'?_format=json';
  console.log('Q: '+jUrl);

It works fine, but unfortunately, it also gives me a 403 without any further Drupal backend processing: - - [07/Jul/2016:15:06:03 +0200] "GET /api/v1/checklawyer/1?_format=json HTTP/1.1" 403 464 "http://proreos/asde/anwalt/1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0"

Console says:

15:17:22.973 "Q: http://proreos/api/v1/checklawyer/1?_format=json"
XHR HTTP/1.1 403 Forbidden

Any idea would be great! Thanks.

  • It's a CORS failure (the clue is the XHR part of your response) - either the site hosting the JS needs to be on the domain proreos, or you need a cross origin access header on the Drupal site – Clive Jul 7 '16 at 13:27
  • It's even more crazy: If I paste the URI into chromium it works, in firefox it does not work - while the request headers are totally ident (except from the UA). – Rainer Feike Jul 7 '16 at 13:28
  • Not crazy at all - a normal HTTP request will work, an XHR won't... – Clive Jul 7 '16 at 13:28
  • Oh, not sure about the FF thing. That's why I stopped using it. Chrome always just works like it should – Clive Jul 7 '16 at 13:29
  • But there is no CrossOrigin, everything is localhost with proreos alias. – Rainer Feike Jul 7 '16 at 13:29

Doomed, I am so stupid. Chrome had the admin cookie, FF had a simple user cookie. I forgot to permit the GET on the new endpoint in the user permissions!!!

So stupid. @Clive: Thanks a lot for your help and sorry for that waste of time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.