Unexpected session reset when making authenticated user REST requests

Question

1. I am using Drupal 7 and Services module

2. To create endpoints for login and subsequent functionality exposed for logged in users

3. As noted here and here, the ideal workflow should be -- Make a POST request with username and password > to end point /user/login (the end point is already enabled) > return data contains Session name and Session id > you join both of them with an '=' in between to form the cookie > you send that cookie in subsequent requests in the request header > these requests automatically get treated as authenticated user requests > All is good

4. But in my case when I do the last step (send cookie in request header) something weird happens. The uid associated with that particular session in the sessions table is set to 0. (In effect the session is authenticated user session anymore, it is not destroyed either, it just goes anonymous)

I am really puzzled by this. I have replicated the behavior on multiple setups, and hoping that this is just a case of me missing something obvious here.

Any help would be much appreciated? Super many thanks in advance.

Answer 1

Well. I found what was causing the error (unexpected behavior) reported above. There are chances that others might get stuck in a similar fashion, so I am answering my own question -

The above resetting of Session was taking place because my service end point was not configured to work with 'authenticated sessions'. When creating a new service endpoint there is an optional checkbox labeled Session authentication with description Choose which authentication schemes that should be used with your endpoint. If no authentication method is selected all requests will be done by an anonymous user. which one needs to check so that web service resources created under that end point and allow authenticated sessions.

If you fail to check this checkbox at the time of creating the endpoint, you could do so later too, by editing the particular endpoint and clicking on the EDIT tab.

Answer 2

I ran into the same issue, but I'd already set session authentication for the service (REST). The request worked fine when my site was installed on root, e.g. "www.domain.com" but did not work when the site was installed in a directory at "www.domain.com/my-directory/

The solution was modifying /sites/default/files/settings.php, line #271:

$base_url = 'www.domain.com/my-directory'; // NO trailing slash!