REST Post creating entities with relations I am having trouble creating comments on nodes ( articles etc. ) with the Rest module. 

I have enabled the endpoint in rest.settings.yml :

resources:
  'entity:node':
    GET:
      supported_formats:
        - hal_json
        - json
      supported_auth:
        - cookie
    POST:
      supported_formats:
        - hal_json
        - json
      supported_auth:
        - basic_auth
  'entity:comment':
    GET:
      supported_formats:
        - hal_json
        - json
      supported_auth:
        - cookie
    POST:
      supported_formats:
        - hal_json
        - json
      supported_auth:
        - basic_auth


I have followed the information here rest tutorial - headless drupal 8 and on drupal.org
I used this tutorial as a base to build my request, noting that there have been changes since the article was posted. 

I am using basic_auth, setting the CSRF token as per issue and I have set permissions for the test user to edit, delete and create articles, basic pages and comments. 

I am using application/json+hal because of the outstanding issue 
with application/json

What is happening is the server is reponding : 

403 Forbidden :
{"error":"Access denied on creating field entity_id"}

The request is failing where checking access on read only fields, which return AccessResult::forbidden();

Clearly I am missing something from my request ? I thought that the hal _links reference points to the entity_id ?

My request so far : 

{
   "_links":{
      "type":{
         "href":"http://d8.dev/rest/type/comment/comment"
      },
      "http://d8.dev/rest/relation/comment/comment/entity_id":[
         {
            "href":"http://d8.dev/node/1?_format=hal_json"
         }
      ],
      "http://d8.dev/rest/relation/comment/comment/uid":[
         {
            "href":"http://d8.dev/user/1?_format=hal_json",
            "lang":"en"
         }
      ]
   },
   "_embedded":{
      "http://d8.dev/rest/relation/comment/comment/entity_id":[
         {
            "_links":{
               "self":{
                  "href":"http://d8.dev/node/1?_format=hal_json"
               },
               "type":{
                  "href":"http://d8.dev/rest/type/node/article"
               }
            },
            "uuid":[
               {
                  "value":"c4b5b929-3ccb-4cfd-8200-0ec8f9170926"
               }
            ]
         }
      ],
      "http://d8.dev/rest/relation/comment/comment/uid":[
         {
            "_links":{
               "self":{
                  "href":"http://d8.dev/user/1?_format=hal_json"
               },
               "type":{
                  "href":"http://d8.dev/rest/type/user/user"
               }
            },
            "uuid":[
               {
                  "value":"76555fc7-c4c4-4e1f-a053-83ab818bba4f"
               }
            ],
            "lang":"en"
         }
      ]
   },
   "comment_type":[
      {
         "target_id":"comment"
      }
   ],
   "comment_body":[
      {
         "value":"Hello world this is a comment",
         "format":"basic_html"
      }
   ],
   "subject":[
      {
         "value":"A comment test"
      }
   ],
   "name":[
      {
         "value":"admin"
      }
   ],
   "thread":[
      {
         "value":"01/"
      }
   ],
   "entity_type":[
      {
         "value":"node"
      }
   ],
  "field_name": [
    {
      "value": "comment"
    }
  ]
}
Okay so this issue is actually a bug. For me the issue was fixed by applying the latest patch for now, likely the patches will need work and tests.

There were issues with my request and I have changed them above to reflect how an actual comment request should look like ( at the time I am writing this ).