7

According to the tutorial An Introduction to RESTful Web Services in Drupal 8, the admin/people/permissions path should contain the following permissions:

RESTful Web Services

But now that I installed the latest version of Drupal, the big surprise is on my website there are no other RESTful module permissions than Administer REST resource configuration, no permissions to grant DELETE, GET, PATCH or POST to each role.

enter image description here

I have Enabled all core web services modules (HAL, HTTP Basic Authentication, RESTful Web Services, Serialization) + REST UI module.

Are those permissions removed from Drupal 8.2.5?

Improve this question
0

1 Answer 1

Reset to default
7

This was introduced since 8.2.0

Accessing entities via REST no longer requires additional REST-specific permissions

This was actually only meant to be a temporary measure, because we already have an Entity Access API that governs access/operations to/on those entities. And in fact, Entity Access is respected when accessing entities via REST. So, there was no more reason for this to exist in Drupal 8.0.x and Drupal 8.1.x, but it was simply forgotten to be removed before Drupal 8.0.0's release. The fact that you needed to grant both those permissions as well as Entity Access needing to grant you access, was a source of confusion and frustration with Drupal 8's REST API, which has now been fixed.

So, as of Drupal 8.2.0, new installations no longer need those permissions to access entities via REST. Existing installations continue to have the old behavior. Existing sites can opt out of that behavior, and opt in to the new behavior, by modifying the rest.settings configuration from

bc_entity_resource_permissions: true

to

bc_entity_resource_permissions: false

(The latter is the default on new Drupal 8.2 installations.)

Improve this answer
3
  • for my case that installed drupal 8.2, in order to get the REST module to work properly, should I left the bc_entity_resource_permissions: false or change it to true?
    – Mdeh
    Jan 20, 2017 at 13:09
  • @Mde leave it false. The previous permissions it had was only temporary. Not having them is how D8 was/is meant to be.
    – No Sssweat
    Jan 20, 2017 at 13:10
  • thanks @No Sssweat, I thought the problem of my following question was this issue: drupal.stackexchange.com/questions/226130/… , but it seems the problem is something else, could you help me solve it? thanks again.
    – Mdeh
    Jan 20, 2017 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.