1

I have created an angular application with headless Drupal. I am using Drupal Services module for web services call from my angular application.

My angular app contains login mechanism which is done using services call. So on login, session id, session name and token are saved and after for each request like GET, POST, PUT, I am using those stored values to authenticate the user at Drupal to do the backend logic.

This session storage is suggested at Drupal service module documentation.

So what happening to me is, on my POST and PUT call, Service module can't able to identify the user and returns "CSRF validation Failed".

On debugging the service module, in this function "_services_sessions_authenticate_call" they are allowing only certain http methods like GET, HEAD, OPTIONS. Hence my POST and PUT call is not allowed and returned as "CSRF Failed".

After modifying the code by allowing POST and PUT in that function, everything works great.

I think modifying the stable module code is not a suggested one. Am I doing anything wrong in request handling or can anyone suggest a standard way to handle authentication?

|improve this question
  • Check once the input you are sending. – DRUPWAY Nov 23 '16 at 10:11
  • You shouldn't disable that check, it's for security. Just make sure you're sending the token you get back from the token endpoint in the HTTP_X_CSRF_TOKEN header from JS – Clive♦ Nov 23 '16 at 10:13
  • @Clive okay. I will do that. is my user authentication handling was correct in my angular app? (like storing session id and session name, and using them with token for each request) – Manikandan Nov 23 '16 at 10:57
  • 1
    A CSRF token is separate from your session tokens, and it needs to be generated for each POST/PUT by making a GET request to /services/session/token'. – mradcliffe Nov 23 '16 at 13:43
  • Services co-maintainer here... the header name is X-CSRF-Token and POST/PUT will work just fine, provided your web host allows those http methods. – tyler.frankenstein Nov 23 '16 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.