I have a REST route that returns a list of user accounts. I have a flag setup called 'following' as you can follow and unfollow other members. In my REST route, I use:

$flag_link = \Drupal::service('flag.link_builder')->build('user', $member->id(), 'following');

which generates the link correctly as far as I can tell. In my javascript object I can see the link that was created. This is an example of the JS object of a user that I use on the front end:

    #access: true
    #action: "flag"
    #attached: {placeholders: {…}, library: Array(1)}
    #attributes: {title: "", href: "/flag/unflag/following/3?destination&token=LEfyLe9PPaQfgNNRSXUA82k4SVHQGRmBEI0adgBva9g", class: Array(1)}
    #cache: {contexts: Array(1), tags: Array(0), max-age: -1}
    #flag: {id: "following", label: "Following"}
    #flaggable: {}
    #theme: "flag"
    #title: {#markup: "Follow this person"}
  id: "3"
  name: "ronnie"
  url: "/user/3"

When I go to click the link it 403 forbiddens with the message message: "'csrf_token' URL query argument is invalid."

The HTML I am outputting is:

<div class="flag">
  <a href="/flag/unflag/following/3?destination&token=LEfyLe9PPaQfgNNRSXUA82k4SVHQGRmBEI0adgBva9g" class="use-ajax" rel="nofollow">Unfollow this person</a>

Any idea what I am doing wrong?

Here is a screen shot of my request when I click the anchor enter image description here

  • What is the connection between the service and your JS? I'm confused on that from your post. I can't really follow how these are connected. What I can say is that you are getting an 403 error because that route expects a CSRF token, which it is not receiving.
    – Jaypan
    May 26, 2020 at 20:15
  • The service returns a JSON object. That JSON object contains some info about users. The service is also returning a Flag link using the link_builder service that ships with the flag module. That is the JS object in that block of code above. I am outputting that flag link in a block. The link looks just like any other flag field that would be output using the entity display page. I was under the impression the token being passed IS the CSRF token. Hopefully that answers your question
    – Ronnie
    May 26, 2020 at 20:22
  • I have only briefly looked at REST as I did not need it, but from the documentation you should be sending that token in a Headers. See section 2.2 : drupal.org/docs/8/core/modules/rest/… May 26, 2020 at 20:38
  • You are passing token. The callback says it is expecting csrf_token. But maybe Neograph's comment is more suited to your problem
    – Jaypan
    May 26, 2020 at 21:21
  • yeah, I am not sure. My request is identical to a flag link when output using a display mode. A regular flag link request does not include the X-CSRF-Token header. In my searches there is another error message similar to this one, but says its missing. Mine is saying its invalid
    – Ronnie
    May 26, 2020 at 21:32

1 Answer 1


I created an example. You can check it and find the solution there.


  • care to expand?
    – Ronnie
    Dec 8, 2020 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.