2

I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?

I finally got it working, but only by passing in my creds with each request. CSRF token header is ignored.

I'm using the Services and Services basic authentication modules.

I do an initial GET request to services/session/token with Basic auth headers with my username/password and get the token as expected. In the next call, POST to rest/user, I have the CSRF token (HTTP_X_CSRF_TOKEN) and Content-type (application/json) and json encoded user data in the body. Instead of authenticating with the token, I get a login popup.

If instead I send the Basic auth headers with my username/password along with the create user request and json data, it works. I don't understand why CSRF is being ignored.

Thoughts?

Edit: One other note. In testing I used both the FF RestClient and FF Poster plugins. I have not tested on Chrome.

  • 2
    The header needs to be named X-CSRF-Token, not HTTP_X_CSRF_TOKEN – Clive Nov 15 '13 at 22:00
  • Thanks Clive. I added the solution to my original post for future users. – bfuzze Nov 18 '13 at 14:31
3

For future users, there's a bunch of confusing examples out there. Based on the above link example this is my working setup:

URL: /rest/user.json

Headers:

"X-CSRF-Token":"fsddfhbusoibdfbdsbfoubewbfw"
"Content-Type":"application/json"

Body:

{
 "name":"username",
 "pass":"password",
 "mail":"email",
 "field_user_full_name":{"und":[{"value":"CHECK1 n CHECK2"}]},
 "roles":[4],
 "status":"1",
 "language":"und"
}
  • Is this for sending multiple values, like an unlimited field? – Kartagis Sep 14 '15 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.