I can authentication and login user with below code in Jquery

    url : "http://domain.com/user/login",
    type : 'post',
    data : 'form_id=user_login_form&name=' + encodeURIComponent("user") + '&pass=' + encodeURIComponent("password"),
    dataType : 'json',
    error : function(data) {
            //error code
    success : function(data) {
        //success code

But is seems this is not safe mode, and I think maybe someone can attack bruteforce to find users password.I want to know is this method safe(I don't think so) and what is solution for make this safe against brute-force login attack.

This Ajax request don't return any Json output,It seems try to login and if authorized then get /user/uid

enter image description here

Note "User login REST format" is similar, but it's not duplicate, and it doesn't have an accepted answer.

  • Possible duplicate of User login REST format
    – mradcliffe
    Jul 12, 2016 at 11:55
  • @mradcliffe no, it is similar but it's not duplicate, also it has not accepted answer.
    – Yuseferi
    Jul 12, 2016 at 12:00
  • I want to know is this method safe(I don't think so) If this wasn't safe, why would Drupal Core allow it?
    – No Sssweat
    Jul 12, 2016 at 13:39
  • As an alternative, you could use Oauth module. Good read: drupalwatchdog.com/volume-4/issue-2/…
    – No Sssweat
    Jul 12, 2016 at 13:41
  • @NoSssweat maybe I should use it integrate with Authentication method, CSRF_token , Oauth, Cookie .... . I didn't much experience with REST Login /authentication.
    – Yuseferi
    Jul 12, 2016 at 13:47

1 Answer 1


Probably because you're a header, should be like this:

enter image description here

enter image description here

    "_links": {
        "type": { 
            "href": "https://yoursite.com/rest/type/node/article"
  "title": [{"value": "test title"}],
  "body": [{"value": "test body"}]
  • still not working. I try both with and without basic authentication.
    – Yuseferi
    Jul 12, 2016 at 10:51
  • which one is correct I focus on it? try with or without Basic Authentication in Authentication Tab?
    – Yuseferi
    Jul 12, 2016 at 10:52
  • is my param name is correct? "name" "pass" and "form_id" ?
    – Yuseferi
    Jul 12, 2016 at 10:54
  • @zhilevan In Body select raw as in my 2nd pic
    – No Sssweat
    Jul 12, 2016 at 10:59
  • 1
    Thanks for you attention, is seems the problem because of postman, ( it worked correctly with Curl and jquery ajax ).
    – Yuseferi
    Jul 12, 2016 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.