REST API doesn't seem to work

Question

Login with CURL:

curl --header "Content-Type: application/json" \
--request POST \
--data '{"name":"admin", "pass":"admin"}'
http://d8.local/drupal-8.5.6/user/login?_format=json

Then the result:

{"current_user":{"uid":"1","roles":["authenticated","administrator"],"name":"admin"},"csrf_token":"LUa3_xAXC8CgDkCoDoKonAmJ8hYFF6gZTak_LpaHFco","logout_token":"90jJUh08H437-F5fU25eq7rS2b8FS22eVVy_Fcsk2TA"}

Look good. But when I tried to check login status:

curl --header "Content-Type: application/json" \
--header "X-CSRF-Token: LUa3_xAXC8CgDkCoDoKonAmJ8hYFF6gZTak_LpaHFco" \
--request GET \
http://d8.local/drupal-8.5.6/user/login_status?_format=json

The results is: 0. So it failed.

Same result when I did with Vue resource.

Note: Postman seems to work, but it's working like real browser without CSRF token need.

Any idea?

Thank you.

Answer 1

REST API doesn't work with CURL because you don't send cookie after login. By default, Drupal 8 using HTTP Basic Authentication after the login user has a cookie. Browser (include postman) will store this cookie and send to the server any request. So It works normally.

If you want REST API working with CURL. You need to store cookie when request login, and send this cookie to check status login like this:

curl -c ~/cookie.txt
--header "Content-Type: application/json" \
--request POST \
--data '{"name":"admin", "pass":"admin"}'\
https://dfs3w.ply.st/user/login?_format=json

in line

-c ~/cookie.txt

mean that write cookie to file cookie.txt.

After login successfully, I will read cookie and send cookie to check status login:

curl -b ~/cookie.txt
--header "Content-Type: application/json" \
--header "X-CSRF-Token: -LSxwKsxEnupbeM4NANfV1JLtlGeqK0dRPxhRRSFvkU"\
--request GET \
https://dfs3w.ply.st/user/login_status?_format=json