I'm getting access denied when hitting the restsws_resource.json route in an anonymous user session. This happens despite the anonymous user having been granted "access resource restws_resource" on the permissions page.
After poking the codebase a little more, I believe this stems from an issue related to the access callback key on restws_resource_discovery_entity_info().
I have a fix (patch incoming momentarily) that defines our access check in a new function, restws_resource_discovery_access and checks for the same credential (access content), but it works appropriately for anonymous users and respects the permissions settings.
Testing notes from comments:
- Install module
- Visit admin -> people -> permissions
- Check "Access the resource restws_resource" for anonymous user
- The route at yoursite.url/restws_resource.json should load
- Then, uncheck the "access the resource restws_resource" checkbox on the permissions page and try again - you should be greeted with a 403
Comments
Comment #2
porkloin commentedPatch is attached!
Comment #3
kristen polThanks for the patch!
Missing doc block.
Extra new line.
Comment #4
porkloin commentedTesting notes:
Comment #5
porkloin commentedUpdated re: code formatting/docblock
Comment #6
porkloin commentedComment #7
porkloin commentedComment #8
kristen polComment #9
kristen polThanks for the update. One nitpick below. I'll try testing.
Sorry I wasn't clear. Not this empty line. The line below.
Extra line.
Comment #10
kristen polSimplytest.me is down so I'll try to test when it's back up.
Comment #11
sokru commentedComment #12
scarer commentedThe patch works for the restws_resource but it does not work for the other types in permissions for example node.
Comment #13
arruk commentedThis patch just seems to push the problem down the road. After applying it, I get a whole host of other 403s for basically every content type. Some of these files resolve when pulled directly using the browser, some of them should be 404s
Comment #14
vijayxtreme commentedI'm seeing the same list of errors as the user above; though the patch pretty much takes care of the initial 403 error, there are more errors that ensue. Anyone else trying to use Gatsby with Drupal 7?
Comment #15
Bauyrzhan Ibraimov commentedI have the same issue when fetching data from gatsby. Is there any workaround?
Comment #16
kristen polNot sure why @sokru marked RTBC but putting back to "Needs work" based on comments.
Comment #17
vacilando commentedSame problem (yes, also with the purpose of using it with Gatsby via https://github.com/porkloin/gatsby-source-drupal7).
Has anyone found a solution or a workaround?
Comment #18
web-htm-mbs commentedSame problem as #17, unable to use gatsby with drupal because it is unable to fetch nodes with error code 403
Comment #19
doana commentedYep, same here. Also trying to use D7 with Gatsby as described in #17.
Comment #20
web-htm-mbs commentedOnly idea I can think to fix this is migrate site to drupal 9 and hopefully the issue is flushed out, what I am currently in the process of for a site with over 40k nodes