1

I defined a custom url using hook_menu and a custom delivery callback that returns json output.

I wanted the url to work on the post method but it is giving access denied for requests done using the post method but it is working without issues for get method.

How do I debug and see why post methods are being denied access?

/**
 * @file
 * Implements menu functions for returning json output.
 */

/**
 * Implements hook_menu().
 */
function mymodule_menu() {
  $items['api/json/select/programs'] = array(
    'access callback' => TRUE,
    'access arguments' => array('access content'), 
    'page callback' => 'mymodule_api_return_aid_program',
    'delivery callback' => 'mymodule_api_json_output_wrapper',
    'type' => MENU_CALLBACK,
    'access callback' => TRUE,
  );
 return $items;
}

/**
 * Custom page callback function - Retuns the uid of the user on passing
 * valid username and passowrd returns error otherwise
 *
 * @return $uid
 *   Uid of the user on success, NULL if other wise
 *
 * @return $status
 *   success of the user on success, failure if otherwise
 */
function mymodule_api_return_aid_program() {
  try {

    // Fetching the primary parameters 
    //product code
    $product = $_POST['product'];
    //country code
    $country = $_POST['country'];
    // language code
    $language = $_POST['language'];


    // age
    //citizenship
    // veteran_status
    $values = _find_product_specific_to_country($product, $country);


    return array('message' => array('nodes' => $values));
  }
  catch(Exception$e) {
    return array('status' => FALSE, 'message' => $e);
    watchdog('Aid API ERROR', $e);
  }
}

/**
 * Custom delivery callback function
 *
 * @param $var
 *   The argument to the delivery callback function
 *
 * @return array
 *   Contains json encoded format of $var on succes,
 */
function mymodule_api_json_output_wrapper($var) {
  // If the access callback is FALSE
  // it will pass MENU ACCESS DENIED to the
  // delivery callback function
    //return drupal_json_output($var);
  if ($var == MENU_ACCESS_DENIED) {

    return drupal_json_output(array('status' => FALSE, 'message' => 'Invalid Token. Access Denied'));
  }
  else {
    return drupal_json_output($var);
  }
}
e
  • Can you please post your current code? – Ismail Cherri Dec 21 '18 at 11:33
  • Do you have the services module enabled? – No Sssweat Dec 29 '18 at 13:53
  • 1
    It was the security kit module that was causing the issue. – Binny Dec 31 '18 at 7:14
3
+100

your code works for me: enter image description here Try to move watchdog before return if there is any exception, will log into your report log.
Change your function to like this:

function mymodule_api_return_aid_program() {
  try {
    // Fetching the primary parameters
    //product code
    $product = $_POST['product'];
    //country code
    $country = $_POST['country'];
    // language code
    $language = $_POST['language'];
    // age
    //citizenship
    // veteran_status
    $values = _find_product_specific_to_country($product, $country);
    return array('message' => array('nodes' => $values));
  } catch (Exception $e) {
    watchdog('mymodule', 'Aid API ERROR ' . $e->getMessage(), array(), WATCHDOG_NOTICE, NULL);
    return array('status' => FALSE, 'message' => $e->getMessage());
  }
}

Update: debug
Getting access denied maybe another module add/alter your menu and add another access arguments then access content so in your callback function print you menu object and see something like :

  $menu_item = menu_get_item('api/json/select/programs');
  // print the menu array
  print_r($menu_item);
  // Print access arguments
  print_r($menu_item['access_arguments']);
  // Print access callback
  print_r($menu_item['access_callback']);
  • Its the delivery call back that checks for access denied errors. The $var parameter is getting 3 which is simply saying that the menu is denied. I know the code works but for this particular site it is not working. Need a way to debug. – Binny Dec 28 '18 at 6:58
  • Check the update, try to print the menu object in your request, if it gives you acces denied page put die; after print_r good luck. – berramou Dec 28 '18 at 8:38
  • Will check and get back – Binny Dec 31 '18 at 5:23
  • 1
    I took your advice and enabled watchdog and paid close attention to the messages. It seems that the Security module is the culprit. It is terming the requests as a security violation and giving access denied errors. The message in dblog is as follows. Possible CSRF attack was blocked. IP address: 192.168.89.98, Origin: chrome-extension://aejoelaoggembcahagimdiliamlcdmfm. Disabling the module is allowing post requests. – Binny Dec 31 '18 at 6:51
-1

You need to setup a REST API endpoint and assign/authorize it to use the POST API calls. the /api should be setup as a REST API endpoint on your website first. Follow this guide on how to use the Services module.

Update: Do not forget to use the CSRF token with a POST request. Check the guide above for more details on how to obtain that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.