When using postman to fire post request I get this message. Does anyone has idea how to disable it? In this case it is post to register user so no authentification is required.

  • Disabling the protection represents a security hole so I doubt there's a built-in way to disable it. CSRF is not related to authentication, it's a separate protection measure, so relying on the user being authenticated isn't enough. See drupal.org/docs/7/security/writing-secure-code/… for more info – Clive Mar 2 '17 at 15:20
  • I put header field X-CSRF-Token with value I got after running get request on my site with sufix /rest/session/token – Nex Mar 3 '17 at 8:12

This is not recommend to remove the X-CSRF-Token. Instead you should get the token from /rest/session/token and add this token in your header with this value.

But if you want to disable it you can write this below line to your settings.php file $conf['services_csrf_token_check_disabled'] = TRUE;


If you are using Drupal 8 to create a POST rest api with oauth2, and postman to test it, you can, in postman, create a new tab using GET, and point to the url:


Then send the request and copy the response token to the POST tab in postman, under the Headers:

X-CSRF-Token          <previous_token>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.