CakePHP REST Authorization problem on POST and PUT (I get 404)

Question

I'm developing a REST api for a application, and everething went fine up until now... I'm building a header with login data, GET and DELETE work fine but when I try to send a PUT or POST request I get 404... When authorization is off (i.e., I do not check it in cake) everything works fine.

Here's the controller code:

class SitesController extends AppController {
    var $uses = array("Site");
    var $name = 'Sites';
    var $scaffold;
    var $components = array('RequestHandler','Security');

    function beforeFilter() {
        $this->Security->loginOptions = array(
            'type'=>'basic'
        );
        $this->Security->loginUsers = array(
            'lukasz'=>'3Lma91c0',
            'test'=>'test'
        );
        $this->Security->requireLogin();
    }

    function index() {
        $sites = $this->Site->find('all');
        $this->set(compact('sites'));
    }

    function view($id) {
        $site = $this->Site->findById($id);
        $this->set(compact('site'));
    }

    function add() {
        if($this->data != null) {
        $this->Site->create();
        if($this->Site->save($this->data))  {
            $message = array('Deleted');
        } else {
            $message = $this->data;
        }
        $this->set(compact("message"));
        }
    }

    function edit($id) {
        $this->Site->id = $id;
        if ($this->Site->save($this->data)) {
            $message = array('Saved');
        } else {
            $message = array('Error');
        }
        $this->set(compact("message"));
    }

    function delete($id) {
        if($this->Site->delete($id)) {
            $message = array('Deleted');
        } else {
            $message = array('Error');
        }
        $this->set(compact("message"));
    }
}

And here's how I send requests:
http://bin.cakephp.org/view/165115685
http://bin.cakephp.org/view/1477117088

Answer 1

I suspect you're running into the CSRF protection (form spoofing protection) the SecurityComponent applies to all POST and PUT requests. Try turning it off using the $validatePost option.