0

I hope it's not a duplicate entry.

I've recently created my Custom Content Entity within a Custom module and I'm currently having trouble with permissions. (Please see permissions below)

enter image description here

The permissions work perfectly when using the add/edit/delete Drupal forms. It throws a 403 if the current user has not the permission, which is great because everything is normal here.

But when I expose the Custom Content Entity via RESTui module : GET, POST, UPDATE. (please see screenshot below). Anonymous users don't get 403 and are able to create, edit.

REST config for my Custom Content Entity

Are the permissions defined under mymodule.permissions.yml only for Drupal entity form ?

How do we define REST permissions for a Custom Content Entity ?

Thank you very much for your help

Improve this question
2
  • How are you testing the petition? I see that you are using a cookie as a authentication mode and I think that your code is correct and is your testing that is wrong. As you supposed, to alter/view a entity using REST you need the same permissions defined to do it using the entity form.
    – estoyausente
    Jul 18, 2018 at 15:00
  • I have a little jQuery AJAX snippet to do my tests. I'm also using my browser in incognito mode with cookies cleared. First, I do a request to "/rest/session/token'" to get CSRF token. and I use jQuery AJAX to either POST or PATCH, with CSRF token in header.
    – R. Couturier
    Jul 18, 2018 at 15:12

1 Answer 1

Reset to default
0

Actually, this was a false positive error.. I did some testing with my REST Client in Chrome (please see screenshot at the end of the paragraph) and permissions are correctly working.

The issue was related to my XHR request which was (for some reasons) keeping a valid CSRF token and because of this I appeared to be identified as admin. And of course as admin ID 1, I was granted full access on CRUD..

Sorry and thanks for your time guys!

enter image description here

Improve this answer
1
  • I supposed that the issue was something related with this (for this reason I ask you about the way to do the test) :)
    – estoyausente
    Jul 19, 2018 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.