When selecting "user" for the authentication and appropriate roles on a RestExport view display, the resulting page will always return 403 unauthorized. The expected behavior was to allow access to the view if the configured roles were matched by the currently logged in user.
The RestExport views display appears to incorrectly determine the checkbox values for authentication types available when configuring the view. As a result, when you select the "user" authentication provider, it provides _auth: user for the view route when it should be providing _auth: cookie. Net result is that without hand-patching the configuration for the view to "cookie", Rest Export view will always return 403 unauthorized when you select the "user" authentication provider.
I have attached what I changed to get the expected behavior of the view.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 2909757-workaround-for-restexport.diff | 601 bytes | jkellendonk |
Comments
Comment #2
jkellendonk commentedComment #3
jkellendonk commentedComment #4
wim leersThis is a known major bug: #2825204: REST views: authentication is broken.