4

Disclaimer: not an experienced Drupal dev here, just a junior dev trying to get things done smoothly. Please excuse naive claims or questions.

I am successfully using a headless Drupal 8 setup that I am querying through Drupal 8 core REST API with basic auth from jQuery AJAX. Now I need to get closer to production conditions, so I started trying to use cookie-based authentication. Problem is that the exact same query that successfully POSTed content using basic auth now returns an HTTP 403.

Hence the question: is there any working example of a POST request to create an article with cookie authentication? Am I missing something?

More details about my setup:

  • Fresh Drupal 8.3.1 install with REST UI, Serialization and HAL modules enabled.
  • REST endpoints configured through REST UI. /node/{node} endpoint set up to allow all requests in all formats with cookie auth. Taxonomy and user endpoints configured likewise.
  • Queries (POST & GET) to REST API made from AJAX calls from jQuery. These queries work fine with basic auth. Example query:
$.ajax({
      url: 'my_drupal/entity/node?_format=hal_json&foo=bar,
      method: 'POST',
      headers: {
        'Content-Type': 'application/hal+json',
        'X-CSRF-Token': csrfToken, // I got that token by first GETting my_drupal/rest/session/token
        'Authorization': 'Basic ' + btoa(this.credentials)
      },
      data: JSON.stringify(node),
      success: function (node) {
         // success logic here
      }
    });

Please note that I already tried removing the Authorization header with no luck.

  • Monitoring HTTP requests, I do see the Drupal authentication cookie being sent along with my POST request.

Thanks in advance for any clue.


EDIT

I tried messing around with the request with no luck so far. I also tried using the CSRF token given back by Drupal after a request on the REST login route with no success.


EDIT²

Following David Thomas' instructions, here is what I tried:

  • Edit drupal/core/modules/rest/config/optional/rest.resource.entity.node.yml in place.
  • Rebuild cache (drush cr).
  • POST new node from jQuery, without the Authorization header.

I tried two configurations in rest.resource.entity.node.yml:

  • Resource based:
granularity: resource
configuration:
  methods:
    - GET
    - POST
    - PATCH
    - DELETE
  formats:
    - hal_json
  authentication:
    - basic_auth
    - cookie
  • Method based:
granularity: method
configuration:
  GET:
    supported_formats:
      - hal_json
    supported_auth:
      - basic_auth
      - cookie
  POST:
    supported_formats:
      - hal_json
    supported_auth:
      - basic_auth
      - cookie

My POST request still got the same response : 403: The used authentication method is not allowed on this route..

Note that editing rest.resource.entity.node.yml did not change anything to the REST UI config page, where the cookie checkbox for all requests to /node/{node} is displayed and checked.

  • Any other errors in your browser JS console? – David Thomas May 8 '17 at 11:44
  • Unfortunately not. Since the latest Drupal update, the 403 error comes with a message saying "Authentication method not allowed on this route". Which IMHO is wrong. – seb-ksl May 9 '17 at 17:26
2

It looks like maybe you are not successfully retrieving the CSRF token. The CSRF token can be retrieved from /rest/session/token.

See https://www.drupal.org/docs/8/core/modules/rest/3-post-for-creating-content-entities for examples on POSTing to core entity endpoints.

  • Woops, my bad. Indeed I get the CSRF token at this URL (/rest/session/token), I made a mistake writing my comment. I edited my first post to make it clearer. Note that the code I show in this first post does work with basic auth. – seb-ksl Apr 29 '17 at 19:20
2

the 403 error comes with a message saying "Authentication method not allowed on this route"

OK, so it appears that route may not support the cookie authentication method, by default.

For example, https://api.drupal.org/api/drupal/core%21modules%21rest%21config%21optional%21rest.resource.entity.node.yml/8.2.x > View source

langcode: en
status: true
dependencies:
  module:
    - basic_auth
    - hal
    - node
id: entity.node
plugin_id: 'entity:node'
granularity: resource
configuration:
  methods:
    - GET
    - POST
    - PATCH
    - DELETE
  formats:
    - hal_json
  authentication:
    - basic_auth

You will need to extend or alter the node resource POST config in rest.resource.entity.node.yml to ensure the "cookie" method is enabled in supported_auth

e.g: Configure in admin UI

node supported_auth

More info: https://www.drupal.org/docs/8/api/restful-web-services-api/restful-web-services-api-overview > "Drupal 8.2 & Later"

  • Thanks a lot for the documented answer! I am unable to try that today, but will do tomorrow. The weird thing is that REST UI does show me the cookie checkbox for all methods of the /node/{node} route (and of course I ticked them), so I assumed it was available. But I will try to figure out what's happening in the yml files. – seb-ksl May 10 '17 at 7:44
  • Just tried following your instructions, please see Edit² in my initial post. – seb-ksl May 11 '17 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.