3

I am using the miniOrange API Authentication module to handle API Key Authorization for my custom Rest Endpoints built by extending the REST Web Services module.

I notice that my POST and PATCH methods work perfectly fine without a CSRF token provided by the /session/token endpoint. Does API Key Authorization remove the need for CSRF tokens or why am I able to make successful POST/PATCH requests without a CSRF Token? I thought they were required...

/**
 * Provides a My Resource
 * 
 * @RestResource(
 *  id = "my_resource",
 *  label = @Translation("My Resource"),
 *  uri_paths = {
 *    "canonical" = "/my_api/test",
 *    "create" = "/my_api/test"
 *  }
 * )
 */
class MyResource extends ResourceBase {

  /**
   * Responds to GET requests.
   * @return \Drupal\rest\ResourceResponse
   */
  public function get() {
    $response = ['message' => 'This GET endpoint still needs to be implemented'];
    return new ResourceResponse($response);
  }

  /**
   * Responds to POST requests.
   * @return \Drupal\rest\ResourceResponse
   */
  public function post() {
    $response = ['message' => 'This POST endpoint still needs to be implemented'];
    return new ResourceResponse($response);
  }

  /**
   * Responds to PATCH requests.
   * @return \Drupal\rest\ResourceResponse
   */
  public function patch() {
    $response = ['message' => 'This PATCH endpoint still needs to be implemented'];
    return new ResourceResponse($response);
  }

2
  • What is the path/url that you're posting those PATCH and POST requests?
    – No Sssweat
    Commented May 24, 2023 at 0:24
  • it's a custom path for a custom API Resource. In this example, the path is /my_api/test as described in the class signature
    – BlondeSwan
    Commented May 24, 2023 at 19:31

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.