I am running Drupal 9 commerce 2.0 as headless CMS, and I am trying to integrate the user registration/user login part of my frontend application. I was able to use the user/register REST API to create users. The default (only option without other modules) authentication was cookie authentication. What I am trying to understand is how the cookie authentication works. When running curl -d @data.json http://example.com/user/register?_format=hal_json --header "Content-Type:application/hal+json" for example, everything works perfectly fine, and the user is created. But don't I need to add a Set-Cookie header for this to work since the REST API has cookie authentication checked? How does this cookie authentication work?
-
This site is set up to answer one question at a time.– cilefenOct 31, 2022 at 23:32
-
Thanks, edited.– levente.nasNov 1, 2022 at 13:13
-
2The cookie header should be in the response, correct? Is this just registering, or are you authenticating that new user somewhere?– KevinNov 1, 2022 at 13:29
-
1Set-Cookie is a response header not a request header.– cilefenNov 1, 2022 at 13:32
-
1Right, the client would then have it. With Curl, there is additional handling needed - see drupal.org/node/1795770– KevinNov 1, 2022 at 13:44
Add a comment
|
1 Answer
When you perform a login using the login endpoint you'll get a cookie back (as well as a CSRF token) which you can then use for subsequent requests instead of doing a fresh login every time.
So with curl something like this:
curl --header "Content-type: application/json"
--request POST \
-s -c cookie.txt \
--data-binary '{"name": "user1", "pass": "pass1"}' \
https://.../user/login
Would get you back a cookie in cookie.txt and the json response will contain your CSRF token.
