1

Login with CURL:

curl --header "Content-Type: application/json" \
--request POST \
--data '{"name":"admin", "pass":"admin"}'
http://d8.local/drupal-8.5.6/user/login?_format=json

Then the result:

{"current_user":{"uid":"1","roles":["authenticated","administrator"],"name":"admin"},"csrf_token":"LUa3_xAXC8CgDkCoDoKonAmJ8hYFF6gZTak_LpaHFco","logout_token":"90jJUh08H437-F5fU25eq7rS2b8FS22eVVy_Fcsk2TA"}

Look good. But when I tried to check login status:

curl --header "Content-Type: application/json" \
--header "X-CSRF-Token: LUa3_xAXC8CgDkCoDoKonAmJ8hYFF6gZTak_LpaHFco" \
--request GET \
http://d8.local/drupal-8.5.6/user/login_status?_format=json

The results is: 0. So it failed.

Same result when I did with Vue resource.

Note: Postman seems to work, but it's working like real browser without CSRF token need.

Any idea?

Thank you.

4

REST API doesn't work with CURL because you don't send cookie after login. By default, Drupal 8 using HTTP Basic Authentication after the login user has a cookie. Browser (include postman) will store this cookie and send to the server any request. So It works normally.

If you want REST API working with CURL. You need to store cookie when request login, and send this cookie to check status login like this:

curl -c ~/cookie.txt
--header "Content-Type: application/json" \
--request POST \
--data '{"name":"admin", "pass":"admin"}'\
https://dfs3w.ply.st/user/login?_format=json

in line

-c ~/cookie.txt

mean that write cookie to file cookie.txt.

After login successfully, I will read cookie and send cookie to check status login:

curl -b ~/cookie.txt
--header "Content-Type: application/json" \
--header "X-CSRF-Token: -LSxwKsxEnupbeM4NANfV1JLtlGeqK0dRPxhRRSFvkU"\
--request GET \
https://dfs3w.ply.st/user/login_status?_format=json
| improve this answer | |
  • Thank you for info. So with cookie set, it's working now and look like CSRF Token is not need. – Cong Nguyen Aug 17 '18 at 1:43
  • Yes, the routing /user/login_status does not need CSRF Token. Every routing has requirement _csrf_token, you need to set X-CSRF-Token to header. ps: Xin chào Việt Nam :D. – MrD Aug 17 '18 at 3:19
  • Great to know. I'm from DA NANG :) – Cong Nguyen Aug 17 '18 at 9:10
  • My skype is doidinhdoi, feel free contact me. :D – MrD Aug 17 '18 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.