I am running Drupal 9 commerce 2.0 as headless CMS, and I am trying to integrate the user registration/user login part of my frontend application. I was able to use the user/register REST API to create users. The default (only option without other modules) authentication was cookie authentication. What I am trying to understand is how the cookie authentication works. When running curl -d @data.json http://example.com/user/register?_format=hal_json --header "Content-Type:application/hal+json" for example, everything works perfectly fine, and the user is created. But don't I need to add a Set-Cookie header for this to work since the REST API has cookie authentication checked? How does this cookie authentication work?

  • This site is set up to answer one question at a time.
    – mona lisa
    Commented Oct 31, 2022 at 23:32
  • Thanks, edited. Commented Nov 1, 2022 at 13:13
  • 2
    The cookie header should be in the response, correct? Is this just registering, or are you authenticating that new user somewhere?
    – Kevin
    Commented Nov 1, 2022 at 13:29
  • 1
    Set-Cookie is a response header not a request header.
    – mona lisa
    Commented Nov 1, 2022 at 13:32
  • 1
    Right, the client would then have it. With Curl, there is additional handling needed - see drupal.org/node/1795770
    – Kevin
    Commented Nov 1, 2022 at 13:44

1 Answer 1


When you perform a login using the login endpoint you'll get a cookie back (as well as a CSRF token) which you can then use for subsequent requests instead of doing a fresh login every time.

So with curl something like this:

curl --header "Content-type: application/json" 
  --request POST \
  -s -c cookie.txt \
  --data-binary '{"name": "user1", "pass": "pass1"}' \

Would get you back a cookie in cookie.txt and the json response will contain your CSRF token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.