I am creating an Angular application using headless Drupal. I am using Drupal services module for web services.

I am trying to implement login mechanism in this app. Login is working fine but to handle authenticated requests, it is necessary to use "Cookie" header in each service call.

My app doesn't allow to use cookie header. In my browser console it says as

"Cookie unsafe header is not allowed". Is there any other way to fix this?

  • I am not having this issue with an angular.js front end that connects to a headless Drupal 7 site using the services module. I make a request to the "login" action. This returns a response with a Response Cookie set. Subsequent http requests made using $http in my angular service works fine. I also use 'system/connect' action with a CSRF token and I get a proper response.
    – mradcliffe
    Nov 23, 2016 at 15:56
  • Can you please tell me the headers name and value you used to set for subsequent authenticated calls?
    – Manikandan
    Nov 23, 2016 at 15:59
  • I am not adding any particular headers other than X-CSRF-Token. I use $http.get({url: '/path/to/user/login', data: {username: '', password: ''}, method: 'POST', headers: {'X-CSRF-Token': 'token'}}); and $http.get({url: '/path/to/user/' + id, method: 'PUT', headers: {'X-CSRF-Token': 'new token'}, data: userData});
    – mradcliffe
    Nov 23, 2016 at 16:09
  • Thanks. For new token, you are replacing with token value obtained from login response. Right?
    – Manikandan
    Nov 23, 2016 at 16:14
  • It's probably a CORS problem; check your server/app settings for allowed cross origin headers
    – Clive
    Nov 23, 2016 at 17:31

1 Answer 1


I have similar setup where i use drupal as back-end and connect to services with Angular app (Ionic App) and i am describing the sequence below; however, you need to consider the below reference if you are doing cross domain


And you have to setup CORS (This is my config for reference)


  1. Login to your drupal service

    End Point: /user/login


    Content-Type: application/json


    Result: User information & Token


enter image description here

  1. Get the Token and use it in subsequent requests by setting the header to X-CSRF-Token

    End Point: /node/100


    Content-Type: application/json


    Result: Node information

Request With X-CSRF-Token header

enter image description here

  1. Logout from drupal service (Token must be set as well)

    End Point: /user/logout


    Content-Type: application/json


    Result: [true]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.