mercredi 9 mars 2016

How should I make sure the user accessing a front-end route is authenticated?

I'm using Laravel and Angular to write a web app.

In the front end Laravel is used to create the basic template, but otherwise controlled by Angular. In the back end laravel is used to create a restful API.

I have a few routes like this:

Route::group(['domain' => 'domain.com'], function() {

    Route::get('/', ['as' => 'home', function () {
        return view('homepage');
    }]);

    Route::get('/login', ['as' => 'login', function () {
        return view('login');
    }]);

    //users should be authenticated before accessing this page
    Route::get('/dashboard', ['as' => 'dashboard', function () {
        return view('dashboard');
    }]); 

});

Route::group(['domain' => 'api.domain.com', 'middleware' => ['oauth']], function() {
    Route::post('/post/create', ['uses' => 'PostController@store']);
    Route::get('/post/{id}', ['uses' => 'PostController@show']);

     //other API endpoints
     // ...
});

I want to make sure my domain.com/dashboard URL is only accessed by authenticated users.

In my backend I have OAuth implemented for my API routes which makes sure the user accessing those routes are authentic. Laravel's Auth::once() is used by the OAuth library to make sure the user credentials are correct then generates an access_token. Since Auth::once() is a "stateless" function no session or cookies are utilized and I cannot use Auth::check() to make sure a user is authenticated.

How should I go about checking to see if the user trying to access domain.com/dashboard is authenticated? Should I send the access_token in the header when I forward the user from /login to /dashboard? Or should I implement Laravel's a session/cookie based authentication?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire