Access denied to custom REST API endpoint for anonymous user

Question

I have developed a custom D8 REST API endpoint, and using the REST UI module, I have enabled it and set access to be allowed for the anonymous user using the permission created by REST UI. However, when I try to access the endpoint - either via Postman or with the D7 Feeds importer - I am unable to access the endpoint because I get a 403 - Forbidden return status code.

The settings for the endpoint in the REST UI settings provides the choices of basic or cookie authentication methods. Is the option of allowing anonymous access to a GET endpoint via the provided permission really doable, or is it required to actually send some type of authentication header?

Thanks.

Answer 1

So it looks like there is a core issue that doesn't permit leaving out some type of REST authentication. The easiest solution appears to be the Feeds HTTPFetcher AA (Advanced Authentication) module, as it allows you to enter your authentication credentials in the custom parser settings. The downside is that I have to create a user (and possibly a role) in D8 for this, but at least it's workable.