Problem/Motivation
Actually if we use the user login form we always receive a 200. We need to receive a 400 for a failed attempt. We want to also verify the logout and the current logged in user status.
How to test
Make sure you apply #2419825: Make serialization_class optional first. (#2419825-1: Make serialization_class optional is now included in this patch)
Once done the URLs will be available automatically.
Set permission for anonymous to allow for login.
curl --header "Content-type: application/json" --header "Accept: application/json" --request POST \'http://drupal.d8/user/login'should give "Missing credentials"
curl --header "Content-type: application/json" --header "Accept: application/json" --request POST \
--data '{"name":"admin"}' \
http://drupal.d8/user/loginshould give "Missing credentials.pass."
curl --header "Content-type: application/json" --header "Accept: application/json" --request POST \
--data '{"name":"admin", "pass":"admin"}' \
http://drupal.d8/user/loginShould return a status code 200 and the information about the current user in an encoded response.
Information returned: uid, roles, and name
curl --header "Content-type: application/json" --header "Accept: application/json" --request POST \
--data \
http://drupal.d8/user/login/statusto make this work you need to manage the cookie from 'login'.
curl --header "Content-type: application/json" --header "Accept: application/json" --request POST \
http://drupal.d8/user/logoutShould return a status code 204.
Proposed resolution
Create a controller for login, login status and logout.
Beta phase evaluation
| Issue category | Feature because actually there's no way to login from a headless app, only using the "User login form" you can login if you need a cookie session but not sure if this is the correct way or, at least, the best way. |
|---|---|
| Issue priority | Major because the cookie session is important in some contexts, for example because Basic auth is not possible with Views (see https://www.drupal.org/node/2076725).So, if you want to create a headless app probably you need, in some cases, a cookie session. See https://groups.drupal.org/node/473598 |
