In my angular app, I am trying to use headless Drupal using service module. I can't able to find a proper documentation to handle session authentication for each subsequent calls. My each request ends in "csrf validation failed" message.

Can anyone suggest a good tutorial or steps to handle session authentication?

1 Answer 1


For any POST, PATCH or DELETE request, you always need to pass along the X-CSRF-Token.

After logging in via REST, the new X-CSRF-Token should be provided in that data result, then you can just set that aside (in a global variable, in local storage, etc) and then pass it along with each request.

I personally use (and created) this module to make things easier: https://www.drupal.org/project/angular_drupal

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.