diff --git a/core/modules/rest/src/Tests/RESTTestBase.php b/core/modules/rest/src/Tests/RESTTestBase.php
index 185a7e8..ec91103 100644
--- a/core/modules/rest/src/Tests/RESTTestBase.php
+++ b/core/modules/rest/src/Tests/RESTTestBase.php
@@ -9,6 +9,7 @@
 
 use Drupal\node\NodeInterface;
 use Drupal\simpletest\WebTestBase;
+use GuzzleHttp\Client;
 
 /**
  * Test helper class that provides a REST client method to send HTTP requests.
@@ -58,6 +59,11 @@
    */
   public static $modules = array('rest', 'entity_test', 'node');
 
+  /**
+   * @var \Psr\Http\Message\ResponseInterface
+   */
+  protected $response;
+
   protected function setUp() {
     parent::setUp();
     $this->defaultFormat = 'hal_json';
@@ -65,6 +71,51 @@ protected function setUp() {
     $this->defaultAuth = array('cookie');
     // Create a test content type for node testing.
     $this->drupalCreateContentType(array('name' => 'resttest', 'type' => 'resttest'));
+
+    $this->cookieFile = $this->publicFilesDirectory . '/cookie.jar';
+  }
+
+  protected function cookieCurlOptions() {
+
+    $cookies = [];
+    foreach ($this->cookies as $key => $cookie) {
+      $cookies[] = $key . '=' . $cookie['value'];
+    }
+
+    $request = \Drupal::request();
+    $cookie_params = $request->cookies;
+    if ($cookie_params->has('XDEBUG_SESSION')) {
+      $cookies[] = 'XDEBUG_SESSION=' . $cookie_params->get('XDEBUG_SESSION');
+    }
+    // For CLI requests, the information is stored in $_SERVER.
+    $server = $request->server;
+    if ($server->has('XDEBUG_CONFIG')) {
+      // $_SERVER['XDEBUG_CONFIG'] has the form "key1=value1 key2=value2 ...".
+      $pairs = explode(' ', $server->get('XDEBUG_CONFIG'));
+      foreach ($pairs as $pair) {
+        list($key, $value) = explode('=', $pair);
+        // Account for key-value pairs being separated by multiple spaces.
+        if (trim($key, ' ') == 'idekey') {
+          $cookies[] = 'XDEBUG_SESSION=' . trim($value, ' ');
+        }
+      }
+    }
+
+    $curl_options = [];
+    // Merge additional cookies in.
+    if (!empty($cookies)) {
+      $curl_options += [
+        CURLOPT_COOKIE => '',
+      ];
+      // Ensure any existing cookie data string ends with the correct separator.
+      if (!empty($curl_options[CURLOPT_COOKIE])) {
+        $curl_options[CURLOPT_COOKIE] = rtrim($curl_options[CURLOPT_COOKIE], '; ') . '; ';
+      }
+      $curl_options[CURLOPT_COOKIE] .= implode('; ', $cookies) . ';';
+    }
+    debug($curl_options);
+
+    return $curl_options;
   }
 
   /**
@@ -86,105 +137,130 @@ protected function httpRequest($url, $method, $body = NULL, $mime_type = NULL) {
     if (!isset($mime_type)) {
       $mime_type = $this->defaultMimeType;
     }
+
     if (!in_array($method, array('GET', 'HEAD', 'OPTIONS', 'TRACE'))) {
       // GET the CSRF token first for writing requests.
       $token = $this->drupalGet('rest/session/token');
     }
 
+    $client = \Drupal::httpClient();
     $url = $this->buildUrl($url);
 
     $curl_options = array();
+    $options = [
+      'http_errors' => FALSE,
+      'curl' => $this->cookieCurlOptions() + [
+          CURLOPT_COOKIEJAR => $this->cookieFile,
+          CURLOPT_HEADERFUNCTION => [&$this, 'curlHeaderCallback'],
+        ],
+    ];
     switch ($method) {
       case 'GET':
-        // Set query if there are additional GET parameters.
-        $curl_options = array(
-          CURLOPT_HTTPGET => TRUE,
-          CURLOPT_CUSTOMREQUEST => 'GET',
-          CURLOPT_URL => $url,
-          CURLOPT_NOBODY => FALSE,
-          CURLOPT_HTTPHEADER => array('Accept: ' . $mime_type),
-        );
+        $options += [
+          'headers' => [
+            'Accept' => $mime_type,
+          ],
+        ];
+        $response = $client->get($url, $options);
         break;
 
-        case 'HEAD':
-          $curl_options = array(
-            CURLOPT_HTTPGET => FALSE,
-            CURLOPT_CUSTOMREQUEST => 'HEAD',
-            CURLOPT_URL => $url,
-            CURLOPT_NOBODY => TRUE,
-            CURLOPT_HTTPHEADER => array('Accept: ' . $mime_type),
-          );
-          break;
+      case 'HEAD':
+        $response = $client->head($url, $options);
+        break;
 
       case 'POST':
-        $curl_options = array(
-          CURLOPT_HTTPGET => FALSE,
-          CURLOPT_POST => TRUE,
-          CURLOPT_POSTFIELDS => $body,
-          CURLOPT_URL => $url,
-          CURLOPT_NOBODY => FALSE,
-          CURLOPT_HTTPHEADER => array(
-            'Content-Type: ' . $mime_type,
-            'X-CSRF-Token: ' . $token,
-          ),
-        );
+        $options += [
+          'headers' => [
+            'Content-Type' => $mime_type,
+            'X-CSRF-Token' => $token
+          ],
+          'body' => $body,
+        ];
+        $response = $client->post($url, $options);
         break;
 
       case 'PUT':
-        $curl_options = array(
-          CURLOPT_HTTPGET => FALSE,
-          CURLOPT_CUSTOMREQUEST => 'PUT',
-          CURLOPT_POSTFIELDS => $body,
-          CURLOPT_URL => $url,
-          CURLOPT_NOBODY => FALSE,
-          CURLOPT_HTTPHEADER => array(
-            'Content-Type: ' . $mime_type,
-            'X-CSRF-Token: ' . $token,
-          ),
-        );
+        $options += [
+          'headers' => [
+            'Content-Type' => $mime_type,
+            'X-CSRF-Token' => $token
+          ],
+          'body' => $body,
+        ];
+        $response = $client->put($url, $options);
         break;
 
       case 'PATCH':
-        $curl_options = array(
-          CURLOPT_HTTPGET => FALSE,
-          CURLOPT_CUSTOMREQUEST => 'PATCH',
-          CURLOPT_POSTFIELDS => $body,
-          CURLOPT_URL => $url,
-          CURLOPT_NOBODY => FALSE,
-          CURLOPT_HTTPHEADER => array(
-            'Content-Type: ' . $mime_type,
-            'X-CSRF-Token: ' . $token,
-          ),
-        );
+        $options += [
+          'headers' => [
+            'Content-Type' => $mime_type,
+            'X-CSRF-Token' => $token
+          ],
+          'body' => $body,
+        ];
+        $response = $client->patch($url, $options);
         break;
 
       case 'DELETE':
-        $curl_options = array(
-          CURLOPT_HTTPGET => FALSE,
-          CURLOPT_CUSTOMREQUEST => 'DELETE',
-          CURLOPT_URL => $url,
-          CURLOPT_NOBODY => FALSE,
-          CURLOPT_HTTPHEADER => array('X-CSRF-Token: ' . $token),
-        );
+        $options += [
+          'headers' => [
+            'X-CSRF-Token' => $token
+          ],
+        ];
+        $response = $client->delete($url, $options);
         break;
     }
 
-    $this->responseBody = $this->curlExec($curl_options);
+    $this->response = $response;
+    $this->responseBody = (string) $response->getBody();
+    $this->setRawContent($this->responseBody);
 
     // Ensure that any changes to variables in the other thread are picked up.
     $this->refreshVariables();
 
-    $headers = $this->drupalGetHeaders();
-
     $this->verbose($method . ' request to: ' . $url .
-      '<hr />Code: ' . curl_getinfo($this->curlHandle, CURLINFO_HTTP_CODE) .
-      '<hr />Response headers: ' . nl2br(print_r($headers, TRUE)) .
+      '<hr />Code: ' . $this->response->getStatusCode() .
+      '<hr />Response headers: ' . nl2br(print_r($response->getHeaders(), TRUE)) .
       '<hr />Response body: ' . $this->responseBody);
 
     return $this->responseBody;
   }
 
   /**
+   * {@inheritdoc}
+   */
+  protected function assertResponse($code, $message = '', $group = 'Browser') {
+    if (!isset($this->response)) {
+      return parent::assertResponse($code, $message, $group);
+    }
+    return $this->assertEqual($code, $this->response->getStatusCode(), $message ? $message : "HTTP response expected $code, actual {$this->response->getStatusCode()}", $group);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function drupalGetHeaders($all_requests = FALSE) {
+    if (!isset($this->response)) {
+      return parent::drupalGetHeaders($all_requests);
+    }
+    return array_map(function (array $header) {
+      return implode(', ', $header);
+    }, $this->response->getHeaders());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function drupalGetHeader($name, $all_requests = FALSE) {
+    if (!isset($this->response)) {
+      return parent::drupalGetHeader($name, $all_requests);
+    }
+    if ($header = $this->response->getHeader($name)) {
+      return implode(', ', $header);
+    }
+  }
+
+  /**
    * Creates entity objects based on their types.
    *
    * @param string $entity_type
@@ -295,6 +371,8 @@ protected function rebuildCache() {
    * override it every time it is omitted.
    */
   protected function curlExec($curl_options, $redirect = FALSE) {
+    unset($this->response);
+
     if (!isset($curl_options[CURLOPT_CUSTOMREQUEST])) {
       if (!empty($curl_options[CURLOPT_HTTPGET])) {
         $curl_options[CURLOPT_CUSTOMREQUEST] = 'GET';
diff --git a/core/modules/rest/src/Tests/UpdateTest.php b/core/modules/rest/src/Tests/UpdateTest.php
index ef18a74..c72ba30 100644
--- a/core/modules/rest/src/Tests/UpdateTest.php
+++ b/core/modules/rest/src/Tests/UpdateTest.php
@@ -190,7 +190,7 @@ public function testUpdateUser() {
     $error = Json::decode($response);
     $this->assertEqual($error['error'], "Unprocessable Entity: validation failed.\nmail: Your current password is missing or incorrect; it's required to change the <em class=\"placeholder\">Email</em>.\n");
 
-    // Try and send the new email with a password.
+    // Try and send the new email with a wrong password.
     $normalized['pass'][0]['existing'] = 'wrong';
     $serialized = $serializer->serialize($normalized, $this->defaultFormat, $context);
     $response = $this->httpRequest($account->urlInfo(), 'PATCH', $serialized, $this->defaultMimeType);
@@ -203,6 +203,7 @@ public function testUpdateUser() {
     $serialized = $serializer->serialize($normalized, $this->defaultFormat, $context);
     $this->httpRequest($account->urlInfo(), 'PATCH', $serialized, $this->defaultMimeType);
     $this->assertResponse(204);
+    $this->curlCookies = $this->cookies;
 
     // Try to change the password without providing the current password.
     $new_password = $this->randomString();