0

I am creating an Angular application using headless Drupal. I am using Drupal services module for web services.

I am trying to implement login mechanism in this app. Login is working fine but to handle authenticated requests, it is necessary to use "Cookie" header in each service call.

My app doesn't allow to use cookie header. In my browser console it says as

"Cookie unsafe header is not allowed". Is there any other way to fix this?

  • I am not having this issue with an angular.js front end that connects to a headless Drupal 7 site using the services module. I make a request to the "login" action. This returns a response with a Response Cookie set. Subsequent http requests made using $http in my angular service works fine. I also use 'system/connect' action with a CSRF token and I get a proper response. – mradcliffe Nov 23 '16 at 15:56
  • Can you please tell me the headers name and value you used to set for subsequent authenticated calls? – Manikandan Nov 23 '16 at 15:59
  • I am not adding any particular headers other than X-CSRF-Token. I use $http.get({url: '/path/to/user/login', data: {username: '', password: ''}, method: 'POST', headers: {'X-CSRF-Token': 'token'}}); and $http.get({url: '/path/to/user/' + id, method: 'PUT', headers: {'X-CSRF-Token': 'new token'}, data: userData}); – mradcliffe Nov 23 '16 at 16:09
  • Thanks. For new token, you are replacing with token value obtained from login response. Right? – Manikandan Nov 23 '16 at 16:14
  • It's probably a CORS problem; check your server/app settings for allowed cross origin headers – Clive Nov 23 '16 at 17:31
0

I have similar setup where i use drupal as back-end and connect to services with Angular Js app (Ionic App) and i am describing the sequence below; however, you need to consider the below reference if you are doing cross domain

https://stackoverflow.com/questions/35007572/angular2-xhrfields-withcredentials-true/

And you have to setup CORS (This is my config for reference)

API/*||POST,GET|Content-Type,x-csrf-token,Authorization|true

  1. Login to your drupal service

    End Point: /user/login

    Payload:{"username":"username","password":"userpass"}

    Content-Type: application/json

    Method:Post

    Result: User information & Token

Request

enter image description here

  1. Get the Token and use it in subsequent requests by setting the header to X-CSRF-Token

    End Point: /node/100

    Payload:Empty

    Content-Type: application/json

    Method:Get

    Result: Node information

Request With X-CSRF-Token header

enter image description here

  1. Logout from drupal service (Token must be set as well)

    End Point: /user/logout

    Payload:Empty

    Content-Type: application/json

    Method:Post

    Result: [true]

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.