Authenticated REST requests becoming anonymous user I'm new to the services and rest_server modules (and RESTful APIs altogether.) As I understand it though, the steps are basically this:


Send a post request to /api/user/login with the username and password set in data
Store the token you get in the response
On subsequent post requests, add the token to the header with the key X-CSRF-TOKEN


When I use the Postman Chrome extension to do that, it works great. When I do it in code, it does api/user/login fine, I get the token, but when I try to access /api/other/endpoint, I get 403 Access denied for user anonymous error.

The first request (/user/login) looks like this:

POST /api/user/login HTTP/1.0
Content-Type: application/json
Accept: application/json
User-Agent: Drupal (+http://drupal.org/)
Host: mysiteurl.com
Content-Length: 41

{"username":"NAME","password":"PASSWORD"}


And the second request (/other/endpoint) looks like this:

POST /api/other/endpoint HTTP/1.0
Content-Type: application/json
Accept: application/json
X-CSRF-TOKEN: vGJm5GNDGumf-SoHnLsBU6d46EkrOZkvUY0CSa08GA0
User-Agent: Drupal (+http://drupal.org/)
Host: mysiteurl.com
Content-Length: 0


If I make requests to /user/token after authenticating, I get new tokens each time. If I try to logout immediately after logging in (and send along that token), I get a "406  Not Acceptable : User is not logged in." error. it tells me user is not logged in.

If I check the site though, it shows the user as successfully having logged in, and still being logged in after the fact.

Do I have to save/send anything regarding the session name/id or cookie? Everything I've been looking at suggests only the session token is necessary.
(Answering my own question, and trying to sound like a third-party so it makes better sense when read...)

It looks like it definitely has something to do with the session/cookie/etc., as subsequent calls seem to be coming from a different client (from the REST server's perspective.) I'm guessing bare PHP has no way of maintaining that cookie, like how a browser would. After looking here, it looks like the cookie needs to be formatted as such in the header of the request:

Cookie: session_name=sessid


(The cookie could also be retrieved from the response's headers->set_cookie variable. The latter will include all the expiration/link info in the string as well. While either method seems to work, I'm not sure if there are any ill-effects from one or the other. I just used the first method because it was the first solution I came across.)

Both session_name and sessid can be taken from the data area of the response after a user/login request. So the  request would ultimately look something like this for a user/logout

POST /api/user/logout HTTP/1.0
Content-Type: application/json
Accept: application/json
X-CSRF-Token: igHUQD11Y8LYdyzHi8m5t33U_tCVZNHE6BbptE4mrwQ
Cookie: SESSd3a1acd26f95229c67cd0a9a1e455bd4=rv-Kbyb8znaGlYBBU5Dn7M2GzkYdWnun5aXcVYLVfvY
User-Agent: Drupal (+http://drupal.org/)
Host: mysiteurl.com
Content-Length: 0