Getting a 403 error in REST & 8.2.3 has no permission set for REST for GET of content

Question

1. Enable modules (including REST UI):

2. Enable the Content in REST resources:

3. Give permissions on /admin/people/permissions#module-rest ??:

4. Request returns 403 Forbidden error:

Reference: Getting a 403 error in REST

Answer 1

This is a known issue with the REST UI module. REST UI has issues with Drupal 8.2 and up. There is an open issue specifically regarding this, and a much longer discussion to look into. I'd post this as a comment, rather than an answer, but I'm a new user here. Best of luck. I'm having the same problem.

UPDATE:

I think REST UI is just a no-go for 8.2.3. Bear with me. I don't have enough reputation to post links :-/

Here is what I did to get some requests to work:

Setting up the REST configurations

In the place of step 2 above, it seems that you need to edit the yml for the entity type you're trying to change the rest configurations for. For example, the node entity would use rest.resource.entity.node.yml (look here for some help: https://www.drupal.org/docs/8/api/restful-web-services-api/restful-web-services-api-overview#practical). I've been given the impression that RESTUI really just isn't useful with 8.2+, so you gotta do it by hand. Once you've created this file to your liking, you need to import it to your site.

I still can't figure out how to do this "correctly"; I don't know if you need to use the configuration importer (which will throw a UUID error) or include it in a theme or in /default/site or what. I did get it to work. I ended up using the Features Module to create a feature package for REST Resource Configuration (admin/config/development/features/edit), downloaded, unzipped, and installed the module created by the changes.

I then manually edited the config files in the created module's directory (DRUPAL_ROOT/modules/MODULE_NAME/config/install/rest.resource.entity.node.yml) to have the settings I wanted. Finally, I implemented the changes by updating the feature from the features config page (admin/config/development/features/ click on the "changed" next to the module you created, click on the checkbox next to the changes, and click "Import Changes").

There HAS to be a simpler way to handle the import, but it works for me on 8.2.3.

User Permissions

Once your REST configurations are set up, the entity types should follow the permissions you have set in /admin/people/permissions/. So, if anonymous users can view published nodes, they should be able to GET published nodes as well, etc. (At least, according to [the documentation][1].)

If you're still having problems, you need to make sure to include the token header usually.

The csrfToken

A GET request to the endpoint YOUR_SITE.DOMAIN/rest/session/token will provide you with a token which you can set as the X-CSRF-Token' header on your GET or POST request. A typical and simple example using jQuery to GET the first entry might look like this:

function getFirstNode() {
  jQuery
    .get('YOURSITE/rest/session/token')
    .done(function (data) {
      var csrfToken = data;
      jQuery.ajax({
        url: 'YOURSITE/web/node/1?_format=hal_json',
        method: 'GET',
        headers: {
          'Content-Type': 'application/hal+json',
          'X-CSRF-Token': csrfToken,
        },
        success: function (node) {
          console.log(node);
        }
      });
  });
}

If all else fails

I've also had success setting up GET endpoints using the Views Module. This article does a pretty good job explaining the process: http://redcrackle.com/blog/rest-export-views-drupal-8. It won't work for POST requests, but it should help.

I hope this helps. It's a really sticky problem for what should be a simple request, and the documentation does NOT do a great job of making this accessible. Good luck!

Answer 2

After

• Implementing the suggestions in the second answer.
• Upgrading to Drupal 8.6.1.
• Reading carefully 3. POST for creating content entities.

I have found that the solution for the 403 Forbidden error is to use this combination:

URL

http://example.com/node?_format=hal_json

Raw request body

{
  "_links": {
    "type": {
      "href": "http://website.com/rest/type/node/article"
    }
  },
  "title":[{"value":"test article55"}],
  "body": [{"value":"test body"}]
}

Headers

Authorization: Basic ....
Content-Type:application/hal+json

Answer 3

I was confused by this as well. Thanks to your post and some other reading, I figured out how to get the REST API working though.

It appears the REST UI module is still not working correctly to enable the API.

So, as already mentioned in another answer, the REST config file rest/config/optional/rest.resource.entity.node.yml is required to make the REST API active in Drupal 8.2+, but it's in the optional directory, so it doesn't appear to get applied by default (even though I think it should, if the dependencies are enabled?).

The only thing I'm adding to your answer is that the easiest way I found to update and enable the rest.resource.entity.node configuration is using the drush cim command.

I copied the rest.resource.entity.node.yml to a temporary directory /app/drush/test/sync/, edited it, and imported it using this command (from the docroot):

$ drush cim --partial --source=/app/drush/test/sync/

You can check that it worked by running this command:

$ drush cget rest.resource.entity.node

In Drupal 8.2+ users should have the same permissions to access entities via the REST API as via the web (HTML). If you set the rest.settings option bc_entity_resource_permissions to true however (the old style), you will need to set access permissions for the API in the Permissions panel.