I have a REST route that returns a list of user accounts. I have a flag setup called 'following' as you can follow and unfollow other members. In my REST route, I use:

$flag_link = \Drupal::service('flag.link_builder')->build('user', $member->id(), 'following');

which generates the link correctly as far as I can tell. In my javascript object I can see the link that was created. This is an example of the JS object of a user that I use on the front end:

    #access: true
    #action: "flag"
    #attached: {placeholders: {…}, library: Array(1)}
    #attributes: {title: "", href: "/flag/unflag/following/3?destination&token=LEfyLe9PPaQfgNNRSXUA82k4SVHQGRmBEI0adgBva9g", class: Array(1)}
    #cache: {contexts: Array(1), tags: Array(0), max-age: -1}
    #flag: {id: "following", label: "Following"}
    #flaggable: {}
    #theme: "flag"
    #title: {#markup: "Follow this person"}
  id: "3"
  name: "ronnie"
  url: "/user/3"

When I go to click the link it 403 forbiddens with the message message: "'csrf_token' URL query argument is invalid."

The HTML I am outputting is:

<div class="flag">
  <a href="/flag/unflag/following/3?destination&token=LEfyLe9PPaQfgNNRSXUA82k4SVHQGRmBEI0adgBva9g" class="use-ajax" rel="nofollow">Unfollow this person</a>

Any idea what I am doing wrong?

Here is a screen shot of my request when I click the anchor enter image description here

  • What is the connection between the service and your JS? I'm confused on that from your post. I can't really follow how these are connected. What I can say is that you are getting an 403 error because that route expects a CSRF token, which it is not receiving. – Jaypan May 26 at 20:15
  • The service returns a JSON object. That JSON object contains some info about users. The service is also returning a Flag link using the link_builder service that ships with the flag module. That is the JS object in that block of code above. I am outputting that flag link in a block. The link looks just like any other flag field that would be output using the entity display page. I was under the impression the token being passed IS the CSRF token. Hopefully that answers your question – Ronnie May 26 at 20:22
  • I have only briefly looked at REST as I did not need it, but from the documentation you should be sending that token in a Headers. See section 2.2 : drupal.org/docs/8/core/modules/rest/… – Neograph734 May 26 at 20:38
  • You are passing token. The callback says it is expecting csrf_token. But maybe Neograph's comment is more suited to your problem – Jaypan May 26 at 21:21
  • yeah, I am not sure. My request is identical to a flag link when output using a display mode. A regular flag link request does not include the X-CSRF-Token header. In my searches there is another error message similar to this one, but says its missing. Mine is saying its invalid – Ronnie May 26 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.