I'm getting access denied when hitting the restsws_resource.json route in an anonymous user session. This happens despite the anonymous user having been granted "access resource restws_resource" on the permissions page.

After poking the codebase a little more, I believe this stems from an issue related to the access callback key on restws_resource_discovery_entity_info().

I have a fix (patch incoming momentarily) that defines our access check in a new function, restws_resource_discovery_access and checks for the same credential (access content), but it works appropriately for anonymous users and respects the permissions settings.

Testing notes from comments:

  1. Install module
  2. Visit admin -> people -> permissions
  3. Check "Access the resource restws_resource" for anonymous user
  4. The route at yoursite.url/restws_resource.json should load
  5. Then, uncheck the "access the resource restws_resource" checkbox on the permissions page and try again - you should be greeted with a 403

Comments

porkloin created an issue. See original summary.

porkloin’s picture

StatusFileSize
new654 bytes

Patch is attached!

kristen pol’s picture

Status: Active » Needs work

Thanks for the patch!

  1. +++ b/restws_resource_discovery.module
    @@ -17,12 +17,17 @@ function restws_resource_discovery_entity_info() {
     
    +function restws_resource_discovery_access() {
    

    Missing doc block.

  2. +++ b/restws_resource_discovery.module
    @@ -17,12 +17,17 @@ function restws_resource_discovery_entity_info() {
    +
    

    Extra new line.

porkloin’s picture

Testing notes:

  1. Install module
  2. visit admin -> people -> permissions
  3. check "Access the resource restws_resource" for anonymous user
  4. The route at yoursite.url/restws_resource.json should load.
  5. Then, uncheck the "access the resource restws_resource" checkbox on the permissions page and try again - you should be greeted with a 403.
porkloin’s picture

StatusFileSize
new863 bytes

Updated re: code formatting/docblock

porkloin’s picture

porkloin’s picture

Status: Needs work » Needs review
kristen pol’s picture

Issue summary: View changes
kristen pol’s picture

Thanks for the update. One nitpick below. I'll try testing.

  1. +++ b/restws_resource_discovery.module
    @@ -4,7 +4,6 @@
     function restws_resource_discovery_entity_info() {
    -
       $info = array();
    

    Sorry I wasn't clear. Not this empty line. The line below.

  2. +++ b/restws_resource_discovery.module
    @@ -17,12 +16,20 @@ function restws_resource_discovery_entity_info() {
    + */
    +function restws_resource_discovery_access() {
    +  return user_access('access content');
    +}
    +
    +
     /**
    

    Extra line.

kristen pol’s picture

Simplytest.me is down so I'll try to test when it's back up.

sokru’s picture

Status: Needs review » Reviewed & tested by the community
scarer’s picture

The patch works for the restws_resource but it does not work for the other types in permissions for example node.

arruk’s picture

This patch just seems to push the problem down the road. After applying it, I get a whole host of other 403s for basically every content type. Some of these files resolve when pulled directly using the browser, some of them should be 404s

Starting to fetch data from Drupal
...file.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...og_membership_type.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...og_membership.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...rate_limit.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...node.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...taxonomy_vocabulary.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...workbench_moderation_transition.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...cache_fragment.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...redirect.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...user.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...paragraphs_item.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
...rules_config.json  Request failed with status code 403
Proceeding anyway, but you should ensure you do not need access to this resource.
vijayxtreme’s picture

I'm seeing the same list of errors as the user above; though the patch pretty much takes care of the initial 403 error, there are more errors that ensue. Anyone else trying to use Gatsby with Drupal 7?

Bauyrzhan Ibraimov’s picture

I have the same issue when fetching data from gatsby. Is there any workaround?

kristen pol’s picture

Assigned: porkloin » Unassigned
Status: Reviewed & tested by the community » Needs work

Not sure why @sokru marked RTBC but putting back to "Needs work" based on comments.

vacilando’s picture

Same problem (yes, also with the purpose of using it with Gatsby via https://github.com/porkloin/gatsby-source-drupal7).

Has anyone found a solution or a workaround?

web-htm-mbs’s picture

Same problem as #17, unable to use gatsby with drupal because it is unable to fetch nodes with error code 403

doana’s picture

Yep, same here. Also trying to use D7 with Gatsby as described in #17.

web-htm-mbs’s picture

Only idea I can think to fix this is migrate site to drupal 9 and hopefully the issue is flushed out, what I am currently in the process of for a site with over 40k nodes