The restws module implements HTTP auth in the optional restws_basic_auth module.
When used in conjunction with the require_login module, running order of hook_init() makes the HTTP auth check happen after require_login's check, so the HTTP auth never happens in reality.
Included is a patch that alters the hook_init() order so that restws_basic_auth's code runs before require_login's (in fact, makes it the first hook_init() to run).
Issue mentioned on require_login's bugtracker as well, on https://www.drupal.org/node/2861820.
Comments
Comment #2
ptaff commented