Why do I get a 403 error? I'm trying to setup a REST server to allow login from external apps.
I managed to get the sequence working using the Poster plugin in Firefox but can't seem to replicate using a small Perl script.
I manage to get the X-CSRF-Token but fail to connect, getting a 403 response.  

This is the sample Perl code.

my $ua = LWP::UserAgent-&gt;new(env_proxy =&gt; 0,
keep_alive =&gt; 0,
timeout =&gt; 60);
$ua-&gt;agent('Mozilla/5.0');

my $req = new HTTP::Request('GET', 'example.com/services/session/token');
my $response = $ua-&gt;request($req);
unless ($response-&gt;is_success) {
    die $response-&gt;status_line;
}
my $token = $response-&gt;content;

my $header= HTTP::Headers-&gt;new;
$header-&gt;header('Content-Type' =&gt; 'application/x-www-form-urlencoded', 'X-CSRF-Token' =&gt; $token);

$req = new HTTP::Request('POST', 'example.com/smartphone_service/system/connect.xml', $header);
$response = $ua-&gt;request($req);


I installed the Services module and REST server locally, and that test worked. Service config is the same as the prod. What could be wrong?
Finally got it. It was mod_security indeed. I could not see errors in my (cpanel) log because I am on a shared host but went ssh and saw it:  

UNSUPPORTED DELAYED Rules: POST request must have a Content-Length header  

$header-&gt;header('Content-Type' =&gt; 'application/x-www-form-urlencoded', 'Content-Length' =&gt; 0, 'X-CSRF-Token' =&gt; $token);


That did the trick

Thank you Molot and David for taking the time to respond