I have created an angular application with headless Drupal. I am using Drupal Services module for web services call from my angular application.
My angular app contains login mechanism which is done using services call. So on login, session id, session name and token are saved and after for each request like GET, POST, PUT, I am using those stored values to authenticate the user at Drupal to do the backend logic.
This session storage is suggested at Drupal service module documentation.
So what happening to me is, on my POST and PUT call, Service module can't able to identify the user and returns "CSRF validation Failed".
On debugging the service module, in this function "_services_sessions_authenticate_call" they are allowing only certain http methods like GET, HEAD, OPTIONS. Hence my POST and PUT call is not allowed and returned as "CSRF Failed".
After modifying the code by allowing POST and PUT in that function, everything works great.
I think modifying the stable module code is not a suggested one. Am I doing anything wrong in request handling or can anyone suggest a standard way to handle authentication?
HTTP_X_CSRF_TOKEN
header from JS – Clive♦ Nov 23 '16 at 10:13/services/session/token'
. – mradcliffe Nov 23 '16 at 13:43X-CSRF-Token
and POST/PUT will work just fine, provided your web host allows those http methods. – tyler.frankenstein Nov 23 '16 at 15:12