slim-jwt-demo

Secure your Slim PHP web services using JWT Authentication

Post Link:- https://trinitytuts.com/secure-your-php-web-services-using-jwt/

slim-jwt-demo's People

Contributors

Stargazers

Watchers

slim-jwt-demo's Issues

set auth route and non auth route?

I am following your tutorial, and done as described. but i do not know how to set the route with authentication and route with no authentication.
What i want is like in my APIs register, login, forgot-password do not require the token.
and rest of APIs needs the token.
This is my Middleware.php

    `use Tuupola\Middleware\HttpBasicAuthentication;
      $container = $app->getContainer();
      $container['logger'] = function($c) {
      $logger = new \Monolog\Logger('logger');
      $file_handler = new \Monolog\Handler\StreamHandler("App/logs/app.log");
      $logger->pushHandler($file_handler);
       return $logger;
       };

$container["jwt"] = function ($container) {
return new StdClass;
};

     $app->add(new \Slim\Middleware\JwtAuthentication([
"path" => "/auth",
    "secure" => false,
    "logger" => $container['logger'],
    "secret" => "devendrasinghchouhan",
    "rules" => [
    new \Slim\Middleware\JwtAuthentication\RequestPathRule([
    "path" => "/auth",
    "passthrough" => ["/token", "/not-secure"]
    ]),
    new \Slim\Middleware\JwtAuthentication\RequestMethodRule([
    "passthrough" => ["OPTIONS"]
    ]),
    ],
   "callback" => function ($request, $response, $arguments) use ($container) {
    $container["jwt"] = $arguments["decoded"];
    },
    "error" => function ($request, $response, $arguments) {
    $data["status"] = "error";
    $data["message"] = $arguments["message"];
    return $response
    ->withHeader("Content-Type", "application/json")
    ->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));
     }
    ]));
    $app->add(new \Slim\Middleware\HttpBasicAuthentication([
   "path" => "/user",
   "secure" => false,
   "users" => [
   "user" => "password"
   ]
   ]));

   $app->add(new \Tuupola\Middleware\Cors([
   "logger" => $container["logger"],
   "origin" => ["*"],
   "methods" => ["GET", "POST", "PUT", "PATCH", "DELETE"],
   "headers.allow" => ["Authorization", "If-Match", "If-Unmodified-Since"],
   "headers.expose" => ["Authorization", "Etag"],
   "credentials" => true,
   "cache" => 60,
   "error" => function ($request, $response, $arguments) {
    return new UnauthorizedResponse($arguments["message"], 401);
    }
    ]));`

And this is my route.php

   `$app->group('/api/v1', function ($app) {            
   $app->group('/auth', function ($app) {

   $app->post("/register",  function ($request, $response, $args) {
   /* Here generate and return JWT to the client. */
   $requested_scopes = $request->getParsedBody() ?: [];
   $now = new DateTime();
   $future = new DateTime("+01 minutes");
   $server = $request->getServerParams();
   $jti = (new Base62)->encode(random_bytes(16));
   $payload = [
   "iat" => $now->getTimeStamp(),
   "exp" => $future->getTimeStamp(),
   "jti" => $jti,
   "sub" => $server["192.168.64.2"]];

   $secret = "devendrasinghchouhan";
   $token = JWT::encode($payload, $secret, "HS256");
   $data["token"] = $token;
   $data["expires"] = $future->getTimeStamp();
   return $response->withStatus(201)
   ->withHeader("Content-Type", "application/json")
   ->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));
    });

    //login
    //forgot-password

       });

     });

      $app->group('/api/v1', function ($app) {           

      $app->group('/user', function ($app) {

      $app->post("/get-user",  function ($request, $response, $args) {
        $data = ["status" => 1, 'msg' => "This route is secure!"];
        $pdo = $this->db->prepare("SELECT * FROM prj_users");
        $pdo->execute();
        $todos = $pdo->fetchAll(PDO::FETCH_ASSOC);
        if (is_null($todos)) {
            $data["status"] = true;
        } else {
            $data["status"] = false;
        }
        return $response->withStatus(200)
        ->withHeader("Content-Type", "application/json")
        ->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));
        });

        });
        });`

I want to run get-user with token. and auth/register without token.

Plus i want to know that do i need to store the token in db for later check?
Or this framework will handle all this?
On what basis its generating the token?
from email address?

Recommend Projects