I created a custom entity, next I enabled (via RESTui) the GET and POST methods. I gave anonymous users permissions to "Access GET", "Access POST" and "Create new content" of that entity.

When I navigate in my browser to "http://mywebsite/my_entity/1?_format=json", I get a proper JSON response. When I navigate to "http://mywebsite/my_entity/add", I can add a new entity.

When I try to POST a new entity via "http://mywebsite/my_entity?_format=json", I get a 403 repsonse with following body:

{ "message": "" }

Does someone have an idea what I'm missing here?

EDIT: When i put a die('give me something') in the method post() of the class "EntityResource" (which is the base class for all entities), the message isn't displayed...

EDIT2: I added headers "Content-Type" and "X-CSRF-Token"

  • 1
    I hope you solved it by now. Hard to answer your question without seeing your body code. – No Sssweat Jan 11 '17 at 8:41

Do you provide a (Basic) authorization header, as well as a X-CSRF-Token header in your POST?

See also: https://www.drupal.org/documentation/modules/rest/start - "2.2 Unsafe methods & CSRF protection: X-CSRF-Token request header"

Edit: So you should at least specify the following HTTP headers:

  • Content-type: application/json
  • X-CSRF-Token: [TOKEN RETURNED FROM A REQUEST TO /rest/session/token]
  • forgot to mention:I did add those headers :) – Robin Aug 10 '16 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.