Services 3.4 has changed REST parameters and Session Authentication breaking Deploy [#2020027]

I have Services 3.4 where some changes to how they do things precipitate changes we need to do to things.

Two I'm looking at right now are the below:

Services 3.4 prevents cross site request forgery by asking for an extra header param in the login and register calls. See #2013781: need Change Record for changes CSRF - 'CSRF validation failed' since update to 3.4, where comment #4 outlines how to get the session token first and then add it to the header.
Services 3.4 seems to change some of the params sent over. A few I found right off the bat were from login (I am so worried that once login works, other params will be strange too!). "username" is now "name", and "password" is now "pass". Crazy, crazy services 3.4

I'm trying to fix my deployment setup but lets get all the patches to catch up Deploy to Services 3.4 here. Or let me know if we already have a place for those.

En Taro Adun

Comments

Comment #1

diwant commented 14 June 2013 at 20:11

Here's what my login code looks like now, and it looks like it is able to move beyond login.

  $logout_url = $this->service->config['url'] . '/user/logout';

  // .. I added this code to fetch the CSRF token

  $csrf_token_url = $this->service->config['url'] . '/services/session/token';
  $csrf_token = drupal_http_request($csrf_token_url, array(
      'method' => 'GET',
  ));

  // .. I modified the keys in the data below and added the token fetched above to the header under the right header key ('X-CSRF-Token')
  
  $options = array(
        'method' => 'POST',
        'headers' => array('Content-Type' => 'application/json', 'X-CSRF-Token'=>$csrf_token),
        'data' => drupal_json_encode(array(
              'name' => $this->config['username'],
              'pass' => $this->config['password'],
        )),
  );

This is near line 32 of deploy/plugins/DeployAuthenticatorSession.inc

Comment #2

diwant commented 14 June 2013 at 21:40

Scratch that. This works better, I've pasted the entire if block so you can compare with yours. This is in 'deploy/plugins/DeployAuthenticatorSession.inc' and I've left the line numbers there

  59       if ($response_data['session_name'] && $response_data['sessid']) {
  60         $this->service->config['headers']['Cookie'] = $response_data['session_name'] . "=" . $response_data['sessid'] . ";";
// NEW CSRF STUFF STARTS HERE
// 1. Fetch the token providing the cookie in the header
  61         $csrf_token_url = substr($this->service->config['url'],0,-5) . '/session/token';
  62         $csrf_token_response = drupal_http_request($csrf_token_url, array(
  63          'method' => 'GET',  
  64          'headers' => array('Cookie'=>$this->service->config['headers']['Cookie']),
  65         ));
// Set the token in the config so it is used in all future requests
  66         $this->service->config['headers']['X-CSRF-Token'] = $csrf_token_response->data;
  67       } else {
  68         throw new DeployAuthenticationException(t("No session was returned from the authentication request."));
  69       }

I think this fixes that issue. Let me know if this is the right approach.

Comment #3

rob_johnston commented 20 June 2013 at 18:28

The patch at comment #2 in #2017767: Error and response with 405 code when try to deploy node solves the problem as well. Some lines of the code are identical to what you provided here, so lets compare, contrast, and discuss which is better.