Problems with Services and CSRF token

Question

I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?

I finally got it working, but only by passing in my creds with each request. CSRF token header is ignored.

I'm using the Services and Services basic authentication modules.

I do an initial GET request to services/session/token with Basic auth headers with my username/password and get the token as expected. In the next call, POST to rest/user, I have the CSRF token (HTTP_X_CSRF_TOKEN) and Content-type (application/json) and json encoded user data in the body. Instead of authenticating with the token, I get a login popup.

If instead I send the Basic auth headers with my username/password along with the create user request and json data, it works. I don't understand why CSRF is being ignored.

Thoughts?

Edit: One other note. In testing I used both the FF RestClient and FF Poster plugins. I have not tested on Chrome.

Answer 1

For future users, there's a bunch of confusing examples out there. Based on the above link example this is my working setup:

URL: /rest/user.json

Headers:

"X-CSRF-Token":"fsddfhbusoibdfbdsbfoubewbfw"
"Content-Type":"application/json"

Body:

{
 "name":"username",
 "pass":"password",
 "mail":"email",
 "field_user_full_name":{"und":[{"value":"CHECK1 n CHECK2"}]},
 "roles":[4],
 "status":"1",
 "language":"und"
}