I can authentication and login user with below code in Jquery

    url : "http://domain.com/user/login",
    type : 'post',
    data : 'form_id=user_login_form&name=' + encodeURIComponent("user") + '&pass=' + encodeURIComponent("password"),
    dataType : 'json',
    error : function(data) {
            //error code
    success : function(data) {
        //success code

But is seems this is not safe mode, and I think maybe someone can attack bruteforce to find users password.I want to know is this method safe(I don't think so) and what is solution for make this safe against brute-force login attack.

This Ajax request don't return any Json output,It seems try to login and if authorized then get /user/uid

enter image description here

Note "User login REST format" is similar, but it's not duplicate, and it doesn't have an accepted answer.

  • Possible duplicate of User login REST format – mradcliffe Jul 12 '16 at 11:55
  • @mradcliffe no, it is similar but it's not duplicate, also it has not accepted answer. – Yusef Jul 12 '16 at 12:00
  • I want to know is this method safe(I don't think so) If this wasn't safe, why would Drupal Core allow it? – No Sssweat Jul 12 '16 at 13:39
  • As an alternative, you could use Oauth module. Good read: drupalwatchdog.com/volume-4/issue-2/… – No Sssweat Jul 12 '16 at 13:41
  • @NoSssweat maybe I should use it integrate with Authentication method, CSRF_token , Oauth, Cookie .... . I didn't much experience with REST Login /authentication. – Yusef Jul 12 '16 at 13:47

Probably because you're a header, should be like this:

enter image description here

enter image description here

    "_links": {
        "type": { 
            "href": "https://yoursite.com/rest/type/node/article"
  "title": [{"value": "test title"}],
  "body": [{"value": "test body"}]
  • still not working. I try both with and without basic authentication. – Yusef Jul 12 '16 at 10:51
  • which one is correct I focus on it? try with or without Basic Authentication in Authentication Tab? – Yusef Jul 12 '16 at 10:52
  • is my param name is correct? "name" "pass" and "form_id" ? – Yusef Jul 12 '16 at 10:54
  • @zhilevan In Body select raw as in my 2nd pic – No Sssweat Jul 12 '16 at 10:59
  • 1
    Thanks for you attention, is seems the problem because of postman, ( it worked correctly with Curl and jquery ajax ). – Yusef Jul 12 '16 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.