Same issue encountered in https://www.drupal.org/project/drupal/issues/2795965 but in the latest recommended version.
Getting this message though provided correct X-CSRF-token.

{
    "message": "X-CSRF-Token request header is invalid"
}

Comments

johnreytanquinco created an issue. See original summary.

johnreytanquinco’s picture

johnreytanquinco commented

After trying to fix for several hours, I found out that this error message only comes when using Postman, but I was able to successfully run PATCH request from online api rest tool.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Title: REST requests with invalid X-CSRF-Token header » REST requests fail in Postman with valid X-CSRF-Token header
Category: Bug report » Support request
Status: Active » Fixed
Issue tags: +Needs steps to reproduce

That is … weird. I wonder what Postman is doing wrong then…

If you can ever come up with steps to reproduce this problem, feel free to reopen!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

kuldeep k’s picture

kuldeep k commented

Got the same issue with an API into POSTMAN. Have you figured it out ?

johnreytanquinco’s picture

johnreytanquinco commented

this is my updated post issue https://www.drupal.org/project/drupal/issues/2976542

Sana.Neyazi’s picture

Sana.Neyazi commented
Version: 8.4.4 » 10.0.x-dev

Getting the same issue with POST API. Although i have provided correct X-CSRF-token.

Alice Heaton’s picture

Alice Heaton commented

For anyone finding this issue now, note you will get this error if you're using OAuth authentication, but still sending a session cookie with your REST request. Make sure the tool you're using to test does not store and send cookies between requests.

This could explain why it failed for POSTMAN but not other tools.

fuegonju’s picture

fuegonju commented
Version: 10.0.x-dev » 9.2.x-dev

Thanks @Alice Heaton, worked for me!

udhaya kumar’s picture

udhaya kumar commented

Thanks @Alice Heaton It works.

To resolve the issue Go to the postman cookies and clear all cookies and send request again you should get a response in API

juancarielo’s picture

juancarielo commented

It worked too, thanks @Alice Heaton.