Not able to send webform submission GET request from JS:

GET /webform_rest/{webform_id}/submission/{sid}?_format=json

What are the headers, values to be sent with submission GET request? Tried with X-CSRF-Token and a couple of others, but could not get webform to submit successfully.

The error i get is:

"responseText":"{\"message\":\"The restful get webform_rest_submission permission is required.\"}","responseJSON":{"message":"The 'restful get webform_rest_submission' permission is required."},"status":403,"statusText":"Forbidden"}

So, looks like i'm not sending the proper header in JS. Note: Have managed to make it work in Postman after login in using another tab, but could not replicate the headers required.

Any help appreciated. Thanks!

Comments

krishnan.n created an issue. See original summary.

krishnan.n’s picture

krishnan.n commented
Title: Not able to get webfor submission to work over JS » Not able to get webform submission to work over JS
Issue summary: View changes
imclean’s picture

imclean commented

You will need to log in first and get a token. For a quick over view of logging in via REST, see: https://drupal.stackexchange.com/a/235712/34673

That said, that permission doesn't seem right. What versions of Drupal and Webform are you using?

krishnan.n’s picture

krishnan.n commented

imclean, thanks for the inputs. Yes, sending the X-CSRF token after login, as mentioned earlier.

This is on Drupal 8.6.9, Webform ver: 8.x-5.2. Webform_rest ver is: 8.x-2.0-beta2+2-dev -- also tried with other versions.

Pl. check (slightly dated; current just has minor changes in how X-CSRF-Token is being sent) code in pastebin here: https://pastebin.ubuntu.com/p/cCDbttqyXq/

The GetServices() does the login, get the tokenand GetServices() attempts to get the webform details. Login succeeds, but not the get webform code.

imclean’s picture

imclean commented

Postman can probably use cookies which can hide auth problems if you're logging in using another tab. To test, please log out with your browser. Then, using Postman only:

  1. Log in via REST
  2. Obtain the returned CSRF Token
  3. Add the CSRF-Token to webform submission request
  4. Retrieve the "Webform Submission" Resource

What do the logs for this show?

In the REST UI, what "Authentication providers" have you enabled for the "Webform submission" resource?

Please note there are 2 "Webform submission" resources. The one this module provides is /webform_rest/{webform_id}/submission/{sid}. I can see from your code example that this is the one you are using.

krishnan.n’s picture

krishnan.n commented

Did the steps you suggested on postman. Output:

{
"message": "The 'restful get webform_rest_submission' permission is required."
}

The URL used: http://devXXX.pantheonsite.io/webform_rest/swl/submission/2?_format=json

Postman Header: X-CSRF-Token JFoWlKx8k_c8nDsQ1eD6Rjl9QUmRt3CUhkQO5ehCvtg

Login seemed to work and returned "csrf_token" and "logout_token"

Let me know if you see something i'm not doing right. TIA.

krishnan.n’s picture

krishnan.n commented

In the RestUI settings, i've tried "Cookie" as well as "Basic Auth". Just to be sure also tried "Method" and "Resource" and all combinations here.

The Drupal admin reports page show all requests as "access denied" errors.

imclean’s picture

imclean commented

It sounds like you've updated Drupal from a version earlier than 8.2 rather than a newer install. If that is the case, you will need to assign the user's role the permission "Access GET on Webform Submission resource". This is under "RESTful Web Services" on the permissions screen.

See: https://www.drupal.org/node/2733435

It explains how to opt out of the old permissions.

So, as of Drupal 8.2.0, new installations no longer need those permissions to access entities via REST. Existing installations continue to have the old behavior. Existing sites can opt out of that behavior, and opt in to the new behavior, by modifying the rest.settings configuration from

bc_entity_resource_permissions: true

to

bc_entity_resource_permissions: false

krishnan.n’s picture

krishnan.n commented

Having some "out of memory issues" with submission, but /webform_rest//elements/ works. Will check more later today, hopefully.

Looks like we're past the "permission denied" issue -- _great_ catch, and thanks.

krishnan.n’s picture

krishnan.n commented

imclean, couldn't get it working on the old instance and couldn't debug why. Spun off a new instance and it "just worked" using X-CSRF-Token, etc as in #5. Tried as admin user login, but should work as normal user.

What you mentioned in #8 is valid, but there appear to be other holes; for example, get 'out of memory' error on submissions, not to mention X-CSRF not enabling connection issue from JS (Postman worked for GET elements)

'still have the old instance and happy to provide you with access, if you like. Thanks for the help.

Will close this issue.

krishnan.n’s picture

krishnan.n commented
Status: Active » Fixed
imclean’s picture

imclean commented

Postman worked for GET elements

Are you logging in with Postman as well, rather than logging in in a separate tab? Maybe try opening a private browsing window then log in via Postman. If it works correctly with Postman then there's a problem with your javascript.

There may also be other issues with your original instance, it might be best to continue with your new install.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.