7

I was reading this article. I would like to know how logging in with the REST API in Drupal 8 works. By default, when users log in, Drupal will verify username and password. After the login, the browser has a cookie for the created session.

enter image description here

With the REST API, how can Drupal 8 verify users the first time they log in? After the login, how does it check the current login?

Improve this question
6
  • 1
    The same way really - it gives you tokens when you login/request a CSRF token, then you send cookies/headers along with subsequent requests containing those values
    – Clive ♦
    Commented May 3, 2017 at 16:51
  • Thank you for help. I'm newbie, so can help me more detail. How can get CSRF token, post CSRF token to server.
    – Jonh
    Commented May 4, 2017 at 8:14
  • John, do you need further information or clarification of my answer below? I'm happy improve it if required.
    – imclean
    Commented May 10, 2017 at 21:15
  • Why was the title of the question changed to remove "REST API"? The question is specifically about the REST API.
    – imclean
    Commented May 11, 2017 at 6:43
  • @imclean The question title doesn't need to contain all the details, which is practically impossible. Then, we don't need tags to be reported in the title too.
    – avpaderno ♦
    Commented May 12, 2017 at 8:16

2 Answers 2

Reset to default
15
+50

Log in to Drupal by POSTing the user credentials. Make sure you set the "Content-Type" header. This starts the user's session.

POST URL:

/user/login?_format=json

Header:

Content-Type: application/json

POST data:

{
  "name": "username",
  "pass": "password"
}

Successful response:

{
  "current_user":{
    "uid": "1",
    "roles":[
      "authenticated",
      "administrator"
    ],
    "name": "username"
  },
  "csrf_token":   "asda09820380_2238019280dk09n908asjdlkajdaoa",
  "logout_token": "asdasd09a8sdaslkdasl-asdasdklsajdlkasdjlksj"
}

Use the CSRF token in subsequent GET, POST, PATCH, DELETE etc. requests by setting the header:

X-CSRF-Token: asda09820380_2238019280dk09n908asjdlkajdaoa

To log out, use the logout token in a POST request. This ends the user's session.

/user/logout?_format=json&token=asdasd09a8sdaslkdasl-asdasdklsajdlkasdjlksj

GET login status:

/user/login_status?_format=json

GET token:

/rest/session/token

References:

Improve this answer
5
  • That's is good. But is difficult for the newbie. Can you take more info about login with postman. Table session stored session has login. And exited login. You can't login again, and can return any response.
    – Jonh
    Commented May 12, 2017 at 2:14
  • Postman could be a separate question. But at first glance it doesn't automatically save the history of requests and responses so you need to manually click "Save" each time. I use Restlet Client. In Postman, make sure you only add the "Content-Type" header and for the body type click "raw". You need to "Save" each response so you can use the tokens again. Drupal sessions are managed the same way as normal. Client side you need to manually manage the tokens for the session.
    – imclean
    Commented May 12, 2017 at 3:47
  • No cookies are set with REST unless your app sets them. Use the tokens instead.
    – imclean
    Commented May 12, 2017 at 3:49
  • @Jonh It looks like Postman doesn't support saving REST responses so I recommend using Restlet client. See: Save responses inside history and collections
    – imclean
    Commented May 12, 2017 at 3:53
  • 1
    I found some problem. Table sessions: Drupal's session handlers read and write into the sessions table. Each record represents a user session, either anonymous or authenticated. Controller /rest/session/token always return value (any user anonymous or authenticated). So if you get token you need login with user first. When /user/login_status?_format=json return value 1. You can't login again to get token. You need logout. If can't logout. You can empty table sessions.
    – Jonh
    Commented May 12, 2017 at 7:55
3

Drupal Core version: 8.x-4.x

You need to enable the user login service first thing, this may be accomplished in so many ways, I prefer using REST UI module.

Go to /admin/config/services/rest and enable User Rest resource.

Once enabled it you can go to /admin/config/services/rest/resource/entity%3Auser/edit by clicking on Edit next to the User resource. Make sure to enable the GET method.

enter image description here

Now you have everything setup, you can start using the service by running this command in the terminal or by using any application for curl requests like: Postman and Restlet clients.

NOTE: CSRF Token can be obtained from: /rest/session/token

curl -i -L -X POST \
  -H "Content-Type:application/json" \
  -H "Accept:application/json" \
  -H "X-CSRF-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
  -d \
     '{
       "name": "my_username",
       "pass": "my_password"
     }' \
'http://SITE-URL/user/login?_format=json'

The return objects are as below:

SUCCESS:

{
  "current_user": {
  "uid": "1",
    "roles": [
      "authenticated"
    ],
    "name": "Admin"
  },
  "csrf_token": "bbbbbbbbbbbbbbbbbbbbbbbbbb",
  "logout_token": "ccccccccccccccccccccccccc"
}

FAILURE:

{
  "message":"Sorry, unrecognized username or password."
}
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.