What are the steps required to reproduce the bug?

  1. Fresh D 8.x installation
  2. Enable rest module
  3. Create some nodes
  4. Add rest export display to the Frontpage /node view with path /node
  5. Request /node with Authorization admin:password and Accept json
    curl --user admin:admin --header 'Accept: application/hal+json' --request GET http://drupal.d8/node
  6. Ends in 403

What behavior were you expecting?

Getting the nodes in json format

What happened instead?

Ends in 403

Comments

dawehner’s picture

Hint: Always provide views exports, its the only human readable format to talk about views, IMHO

  • Request the /foo with Authorization admin:password and Accept json
  • I guess you talk about basic auth? Have you configured basic auth in your view?

    chr.fritsch’s picture

    Yes i talk about basic auth. What do you mean with configure? Have i overlooked some configuration possibilities?

    dawehner’s picture

    clemens.tolboom’s picture

    Title: Access check for rest views ends in 403 » Basic auth access check for rest views ends in 403
    Issue summary: View changes
    Related issues: +#2286971: Remove dependency of current_user on request and authentication manager, +#2432585: Improve authentication manager service construction to support custom global service providers

    Crap ... spent too much time debugging instead of searching to find this issue.

    I guess this got broken by #2286971: Remove dependency of current_user on request and authentication manager or #2432585: Improve authentication manager service construction to support custom global service providers

    Requesting views with basic auth falls back to the globalProviders which has none for basic_auth.

    core/lib/Drupal/Core/Authentication/AuthenticationManager.php:217

      protected function defaultFilter(Request $request, $provider_id) {
        $route = RouteMatch::createFromRequest($request)->getRouteObject();
        $has_auth_option = isset($route) && $route->hasOption('_auth');
    
        if ($has_auth_option) {
          return in_array($provider_id, $route->getOption('_auth'));
        }
        else {
          return isset($this->globalProviders[$provider_id]);
        }
      }
    

    Hacking core/lib/Drupal/Core/Authentication/AuthenticationManager.php:66

      public function addProvider(AuthenticationProviderInterface $provider, $provider_id, $priority = 0, $global = FALSE) {
    ...
    //    if ($global) {
          $this->globalProviders[$provider_id] = TRUE;
    //    }
    

    gives a decent response :)

    clemens.tolboom’s picture

    As #2228141: Add authentication support to REST views IS what we need I try to reroll that issue.

    clemens.tolboom’s picture

    Status: Active » Closed (duplicate)

    I've rerolled #2228141: Add authentication support to REST views and manually tested it. Now my curl command works again.

    I close this as a duplicate (closest state I guess) of mentioned issue as we have a fix.