POST: 403 error in REST I created a custom entity, next I enabled (via RESTui) the GET and POST methods. I gave anonymous users permissions to "Access GET", "Access POST" and "Create new content" of that entity.

When I navigate in my browser to "http://mywebsite/my_entity/1?_format=json", I get a proper JSON response. When I navigate to "http://mywebsite/my_entity/add", I can add a new entity.

When I try to POST a new entity via "http://mywebsite/my_entity?_format=json", I get a 403 repsonse with following body:


  {   "message": "" }


Does someone have an idea what I'm missing here?

EDIT: When i put a die('give me something') in the method post() of the class "EntityResource" (which is the base class for all entities), the message isn't displayed... 

EDIT2: I added headers "Content-Type" and "X-CSRF-Token"
Do you provide a (Basic) authorization header, as well as a X-CSRF-Token header in your POST?

See also:
https://www.drupal.org/documentation/modules/rest/start - "2.2 Unsafe methods &amp; CSRF protection: X-CSRF-Token request header"

Edit:
So you should at least specify the following HTTP headers:


Content-type: application/json
X-CSRF-Token: [TOKEN RETURNED FROM A REQUEST TO /rest/session/token]