I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?

I finally got it working, but only by passing in my creds with each request. CSRF token header is ignored.

I'm using the Services and Services basic authentication modules.

I do an initial GET request to services/session/token with Basic auth headers with my username/password and get the token as expected. In the next call, POST to rest/user, I have the CSRF token (HTTP_X_CSRF_TOKEN) and Content-type (application/json) and json encoded user data in the body. Instead of authenticating with the token, I get a login popup.

If instead I send the Basic auth headers with my username/password along with the create user request and json data, it works. I don't understand why CSRF is being ignored.


Edit: One other note. In testing I used both the FF RestClient and FF Poster plugins. I have not tested on Chrome.

  • 2
    The header needs to be named X-CSRF-Token, not HTTP_X_CSRF_TOKEN
    – Clive
    Commented Nov 15, 2013 at 22:00
  • Thanks Clive. I added the solution to my original post for future users.
    – bfuzze
    Commented Nov 18, 2013 at 14:31

1 Answer 1


For future users, there's a bunch of confusing examples out there. Based on the above link example this is my working setup:

URL: /rest/user.json




 "field_user_full_name":{"und":[{"value":"CHECK1 n CHECK2"}]},
  • Is this for sending multiple values, like an unlimited field?
    – Kartagis
    Commented Sep 14, 2015 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.