Comments (9)
Great, I merged and tagged as 2.0.4 :)
from auth.
Out of curiosity - what's the use case for having a route that is protected by both a token or a cookie? Since normally a cookie (browser) request returns a View and a token request returns JSON.
The middleware is behaving as expected unfortunately - there's no way to 'skip' a middleware in the chain. If you want to do that you'll need to write a custom middleware that checks for an authenticated user before trying to do a look up again. Or wraps the two middlewares and works out which one to use.
from auth.
I'm not super familiar with front end stuff so if this isn't the way to do it please let me know. But I have a Vapor API (all JSON routes) that supports an iOS app and two React frontends. I want to use cookie based for the frontends as that is more secure (using an http only cookie). For the iOS app, token based is more preferred. I would have thought this is a common use case, but I guess not!
from auth.
Ah ok, I see what you mean. So (I think) the usual way of doing it is to provide a token to the front end that it uses to make requests. Note that if you use HTTP only cookies, you won't be able to use them with your React front-end (since that's JS obviously and it won't have access to the cookies)
from auth.
I was doing it that way, but there is not secure way to store a token in web storage (that I could find). Any JS can read the local storage and have the token.
I do actually have it working with React and an http cookie, (using axios at least) it is included automatically using the withCredentials
option.
from auth.
This seems like it could be an oversight in the session auth middleware. The rest of the middleware have a guard statement at the beginning that check to see if authentication has already been performed:
But this is lacking in the session auth middleware:
from auth.
Let me know if this seems like it will do the trick: #69
from auth.
@tanner0101 that fixes it! Thank you 👏
from auth.
I think it's worth adding something about this use case to the docs as an example. A lot of people are building APIs to accommodate both mobile and web based apps using libraries/frameworks like React, Vue, Angular, etc. It's convenient (and more secure) to leverage cookies for authentication when we're building web apps.
It's easy to pass a flag to fetch
or an XHR to tell the browser to include credentials (ie. cookies) with any api requests.
from auth.
Related Issues (20)
- Conforming Fluent models to BasicAuthenticable when username/password types are optional (i.e. String?) HOT 4
- Can not generate Xcode project HOT 2
- Protected routes can still be hit after calling `unauthenticate(_:)` HOT 4
- Should AuthenticationCache be public? HOT 2
- Stable release? HOT 3
- Route using SQLite model and SessionMiddleware timeouts when ran on ubuntu. HOT 4
- unauthenticate() should remove session when using authSessionsMiddleware
- consider including JWT by default HOT 5
- web session cookie expired on login HOT 1
- Would it be possible to avoid depending on the Vapor package?
- Unable to remove sessions with AuthenticationSessionsMiddleware enabled HOT 3
- Problem with Auth 2.0.2 HOT 2
- /Sources/Authentication/Persist/SessionAuthenticatable.swift:44:19: error: value of type 'Request' has no member 'hasSession'; did you mean 'session'? HOT 2
- Token should be encrypted HOT 6
- Remove reliance on DatabaseKit/Fluent HOT 4
- `AuthenticationSessionsMiddleware` should use a connection pool HOT 10
- Request has no member 'hasSession' HOT 9
- Auth doesn't finish build with vapor 4 HOT 1
- BasicAuthenticatable for non-final classes HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from auth.