Headless Drupal 8 - cookie authentication I am successfully using a headless Drupal 8 setup that I am querying through Drupal 8 core REST API with basic auth from jQuery AJAX. Now I need to get closer to production conditions, so I started trying to use cookie-based authentication. Problem is that the exact same query that successfully POSTed content using basic auth now returns an HTTP 403.

Is there any working example of a POST request to create an article with cookie authentication? Am I missing something?

I have a fresh Drupal 8.3.1 install with REST UI, Serialization and HAL modules enabled. The REST endpoints are configured through REST UI. The /node/{node} endpoint is set up to allow all requests in all formats with cookie auth. Taxonomy and user endpoints are configured likewise.
The queries (POST &amp; GET) to REST API are made from AJAX calls from jQuery. These queries work fine with basic auth. This is a query example.

$.ajax({
      url: 'my_drupal/entity/node?_format=hal_json&amp;foo=bar,
      method: 'POST',
      headers: {
        'Content-Type': 'application/hal+json',
        'X-CSRF-Token': csrfToken, // I got that token by first GETting my_drupal/rest/session/token
        'Authorization': 'Basic ' + btoa(this.credentials)
      },
      data: JSON.stringify(node),
      success: function (node) {
         // success logic here
      }
    });


Please note that I already tried removing the Authorization header with no luck.

Monitoring HTTP requests, I do see the Drupal authentication cookie being sent along with my POST request.
It looks like maybe you are not successfully retrieving the CSRF token. The CSRF token can be retrieved from /rest/session/token. 

See https://www.drupal.org/docs/8/core/modules/rest/3-post-for-creating-content-entities for examples on POSTing to core entity endpoints.