Drupal API Authentication Features Overview & Setup

Overview

Drupal’s API Authentication module offers key features to secure JSON API and REST APIs. It allows blocking or allowing specific IP addresses, restricting access to selected or custom API endpoints, and applying role-based controls to manage API access. Flood Control helps prevent brute-force attacks, and Token Revocation enables revoking previously issued access tokens.

Role-Based Access:

The Role-Based Access setting in Drupal allows you to control access to specific API routes based on user roles. By configuring this option, you can define which roles are permitted to access certain endpoints while all other roles will be restricted. This ensures that sensitive APIs remain protected and accessible only to authorized users.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select Role-Based Access.
• Choose the Drupal role you want to grant API access to, then enter the API routes that the selected role should have access to.
• Only the chosen Drupal role will be able to access the specified APIs.
• To add more Drupal roles, simply click the Add button below.
• Once done, click on the Save All Advanced settings button.

Restrict Custom APIs:

The Restrict Custom APIs feature allows admins to limit access to selected custom APIs. It keeps your APIs secure and ensures they are used safely.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select Restrict custom APIs.
• Enter the custom API you want to restrict in the You can add the APIs here field. To add multiple APIs, enter each one on a new line.
• Once done, click on the Save All Advanced settings button.

Allow & Restrict IP Addresses:

The Allow & Restrict IP Addresses feature improves API security by controlling access through IPs. You can allow only trusted IPs or block specific ones, ensuring that only authorized systems can use the APIs.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select Allow & Restrict IP Addresses.
• Select whether you want to allow or block IP addresses.
• Enter the IP address in the You can add the IP Addresses here field. To add multiple IP addresses, separate them with a semicolon (;).
• Once done, click on the Save All Advanced settings button.

APIs to be Restricted:

The APIs to be Restricted feature lets you control access to specific APIs, including JSON APIs, RESTful APIs, and custom APIs. It enhances security by enforcing authentication for these APIs.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select APIs to be Restricted.
• Enable the checkbox for the type of API you want to restrict. When making API requests, ensure that the request format for both JSON and REST APIs matches the format specified in the module.
• Once done, click on the Save All Advanced settings button.

Flood Control:

It restricts the number of failed authentication attempts allowed within a set time frame for each user account or IP address. Once the limit is reached, further login attempts are blocked for the configured time window.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select Flood Control.
• Under Maximum Failed Attempts, set the number of failed login attempts allowed before an IP address is blocked.
• In Time Window (seconds), set the duration for tracking failed login attempts.
• Once done, click on the Save All Advanced settings button.

Token Revocation:

This endpoint is used to revoke an access token generated by the module. Send a POST request to the endpoint with the OAuth/Access Token authentication method enabled, and include the token to be revoked in the request body.

• Navigate to the Advanced Settings tab of the module.
• From the vertical tab, select Token Revocation.
• Use the Revocation Endpoint:

   https://your-drupal-site/rest_api/revoke 

• Authorization: Bearer Token: If the token is valid, the API responds with a success message confirming that the token was revoked.
• Send a POST request to the endpoint with the above parameters.
• On successful revocation, you will receive a response:

{
  "status": "success",
  "message": "Token revoked successfully"
}

• Once done, click on the Save All Advanced settings button.

Related Articles

• Drupal API Authentication
• API Authentication Methods

If the configuration was not successful, please contact us at drupalsupport@xecurify.com. Kindly include a screenshot of the error window, and we will assist you in resolving the issue and guide you through the setup.