Download Size md5 hash
restws-7.x-2.0-alpha4.tar.gz 31.1 KB 10f192640bae085ce9493787d4cf4f3a 40.38 KB 077b3ad4693efaba92e8d236d67a16a9
Last updated: January 16, 2013 - 14:49

Release notes

See also SA-CONTRIB-2013-003

This release comes with a major API change for clients. A security token has been introduced to guard against CSRF attacks. This change only affects you if

* your client uses cookie-based user authentication and
* your client performs write operations (POST, PUT or DELETE).

Clients that only read data (GET requests) still work the same. Clients that use other authentication mechanisms (like restws_basic_auth) remain unaffected as well.

In order to still write to your Drupal installation those cookie-using clients need to add an X-CSRF-Token header to their HTTP requests. The token can be retrieved from (replace the URL with your site accordingly). You can also generate the token yourself and deliver it with JavaScript settings on the HTML page if you are calling back to the web service interface from JavaScript. That avoids an additional HTTP request just to get the token:

(array('restws_csrf_token' => drupal_get_token('restws')), 'setting');

An example for the usage of the X-CSRF-Token header with PHP's cURL can be found in the Simpletests.

Changes since 7.x-2.0-alpha3:

  • Introduced a session token for write operations from cookie-based clients.
  • #1878064 by whurleyf1: Added alter hook for response.
View change notices for this release
Official release from tag: