I'm building an app using Angular 2 (no known as 4) as frontend and Laravel 5.4 as API backend. I'm using Laravel's passport password grant feature to authenticate user access to API.
The Frontend is not directly accessing oauth routes. My custom auth controller is talking to oauth/token to get the grant values.
This setup is working perfectly fine in my local environment, but in AWS EC2 it throws 500 internal server error.
I thought it could be related to GuzzleHttp\Client, but it was not. Even if I try to access oauth/token directly from Postman, it still throws 500 internal server error.
private function getPasswordGrant($username, $rawPassword) {
$http = new HttpClient();
$url = url('/') . "/oauth/token";
return $http->post($url, [
"form_params" => [
"grant_type" => "password",
"client_id" => config("auth.oauth_password_grant_client_id"),
"client_secret" => config("auth.oauth_password_grant_client_secret_key"),
"username" => $username,
"password" => $rawPassword,
"scope" => "*",
],
]);
}
This is the function in my custom Auth Controller which requests for password grant after the user being authenticated in another method (login and signup).
Most amazing thing is there's nothing logged in either laravel or apache logs.
Alright, after a lot of struggle and debugging. It turned out to be apache was unable to write into storage/logs/laravel.log and causing this problem. After giving appropriate permissions to storage/ folder everything is working as expected.
Related
I have been working with Laravel since version 5.X up to version 8.X but always use it for backend API (never used blade template), and always pair it with VueJS on the front-end using JWT authentication (also never messed with any other authentication method).
Now with Laravel 9 and Vue 3, Im trying to use native Laravel Jetstream that uses SANCTUM and Vue+Inertia JS, and I'm quite lost with the authentication process. with JWT method, once the user succesfully login on the browser, all api request to Laravel will be authenticated using Authoraziation header. but this seems a different case with Sanctum.
After deploying and installing Jetstream and completed all the set-up. I created a user and loggedin with that user details. and I notice few things, there is a default API route
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
return $request->user();
});
when I tried to directly access my.domain/api/user I notice it was redirected to GET /login
then redirected again to GET /dashboard
I then created a test api route using below
Route::get('test', function( Request $req) {
dd( [
'test' => $req->all(),
'user' => auth()->user(),
'request' => $req
] );
});
and I notice this request is not authenticated even when the cookies is present on the request as Im when I'm alraedy logged-in on the same browser, the auth()->user() is null.
I tried adding auth:sanctum middleware
Route::middleware('auth:sanctum')->get('test', function( Request $req) {
dd( [
'test' => $req->all(),
'user' => auth()->user(),
'request' => $req
] );
});
but having sanctum middle behave the same as the api/user where if i open api/test directly on the browser, it gets redirected to GET /login then redirected again to GET /dashboard and I'm quite lost at this point. I tried reading the docs and it says I have to do a separate authentication for this that would issue an API token and I was thinking I might better be going back with using JWT auth as it seems a lot easier to deal with.
So my question is; How can I authenticate an API end-point without having to redirect it to /login then /dashboard if the user is already logged in on my application using default sanctum authentication.
My goal is just to simply create /api/test that will be automatically authenticated if user already loggedin on the same browser and return the data I set on its return value and not doing any redirects.
Appreciate any help
I have got the same issue with laravel8
Jetstream and inertia vue3.
Am looking for the solution since 3 days posting messages on discord, searching on YouTube and more but nothing.
When i make an api call from your SPA to laravel, i got UNAUTHENTICATED response.
on postman you need put
headers
Accept = application/json
this tells your application know how works with Json
and go stop redirect to "Login"
I have this backend application running on Laravel 7.23.2 where I used tymondesigns / jwt-auth 1.0.0. The application is running on Linux.
The frontend is using Vue. The authentication happens just fine, I get the jwt token. After a successful authentication the frontend does several api calls passing the token in head, but I keep getting this 401 error. The same code works just fine on my local computer.
I did change the jwt_secret and clear the cache, but still not working.
Route::group(['middleware' => 'jwt.auth', 'namespace' => 'API'], function() {
Route::get('/com/page/{pageSize}', 'ComController#all')->middleware('role:Admin');
Route::get('/com/pesquisa/{anoMes}/{pageSize}', 'ComController#findByAnoMesAndFilters')->middleware('role:Informante|Gerente|Admin');
This is just a snapshot of my api.php file.
Does any one would have any idea what could be the main issue?
Let me know if further information is needed.
I´m also using https on the backend production, on localhost I use http.
How do I combine Passport authentication and normal laravel authentication?
I want the user to be logged in on pages of web-middleware and api-middleware. The login route is in api-middleware. Currently I have set up Passport authentication and it works fine for all api-middleware routes. How to make the user logged in in web-middleware as well?
Edit #1
What Im doing:
Login code
$http = new \GuzzleHttp\Client();
try {
$response = $http->post(config('services.passport.login_endpoint'), [
'form_params' => [
'grant_type' => 'password',
'client_id' => config('services.passport.client_id'),
'client_secret' => config('services.passport.client_secret'),
'username' => $args['email'],
'password' => $args['password']
]
]);
$user = User::where('email', $args['email'])->first();
Auth::guard('web')->login($user);
return [
"token" => $response->getBody()->getContents(),
"user" => $user
];
} // ...
Somewhere in some web-middleware route
return auth()->check() ? "logged in" : "not logged in";
returns "not logged in"
Ideally you shouldn't, as passport auth is for a separate app communicating to the API and laravel preshipped auth is for MVC, they are separate user sessions.
But assuming you know what you are doing, either call Auth::login($user); on user login via API, or generate the passport token when the user login through web middleware auth, whichever login happens first...
Remember Auth::login($user); creates a user session and sets cookies to refer to that session... So you create for yourself a new problem were on logout, there are two places to logout from... as technically the user is logged in twice, with passport token and with a cookie referring to his session...
Actually I'm in a situation like you were. I have searched a lot about it. I always needed web authentication because of nature of my projects but in addition I started to develop projects with api backend soo late in comparing with web development world.
I'm a bit lazy so I generally use Laravel Passport and without working always out of the box, it does the job so in my opinion if you want just the functionality of access tokens for api security, put your user login authentication on web side and just authenticate the api endpoints with auth:api middleware in your api.php file.
I know that that's not the best practice but since it sounds that you are not developing a pure Laravel SPA then you can follow the route for Laravel Multipage application with Vue powered.
But believe me best way is to use either web authentication or api authentication not together then as the above answer says, you will have two authentication working at the same time which does not sound ok.
At the end, when you want to get the authenticated user on blade templates you will use
auth()->user()
but on the other hand in api controllers you should use
auth('api')->user()
which is nice to have but dangerouse to use.
If you need to log an existing user instance into your application, you may call the login method with the user instance.
Auth::login($user);
You can also use the guard() method:
Auth::guard('web')->login($user);
See the documentation here for more information: https://laravel.com/docs/5.8/authentication#authenticating-users
First to say that I already implement session based facebook login with laravel socialite and I registered proper facebook acc for developers and create app, but because of SPA I need to change to stateless solution...
The redirect throws "Response for preflight is invalid (redirect)" and check the following config, images and code...
My vue.js app works on localhost:8080 and backend laravel app on localhost:8000
I installed barryvdh/laravel-cors an
d implement standard login with JWTToken
I already install laravel socialite
So, I setup config/services with proper credentials already
'facebook' => [
'client_id' => 'xxxxxxxx',
'client_secret' => 'xxxxxxxxx',
'redirect' => 'http://localhost:8000/login/facebook/callback',
]
I also register a good routes and I tested them 1000 times...
And when a GET send request it cannot be redirected on fb because of Response for preflight is invalid (redirect):
SocialiteController
public function redirectToFacebookProvider()
{
return Socialite::driver('facebook')->stateless()->redirect(); // this throws error !!!
}
the error which I get in console is like on picture
It should open to me a popup to login on facebook ?
Why I have trouble with this redirect ?
Any help ?
i am using https://github.com/lucadegasperi/oauth2-server-laravel in laravel framework for creating Api's. i configured all setup. when i make a call to get token it shows
{ "error": "invalid_request", "error_description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the "grant_type" parameter." }
My grant type is -
'grant_types' => [ 'client_credentials' => [ 'class' => '\League\OAuth2\Server\Grant\ClientCredentialsGrant', 'access_token_ttl' => 3600 ] ],
token is -
'token_type' => 'League\OAuth2\Server\TokenType\Bearer', i need sample url for access my api.. whether i need to pass access token where can i get access token.
i dont find any tut about geting access token and use them correctly. please help me on this..
thanks in advance.
I am using the same package with laravel 5. There is this tutorial that explains it well.
After you publish the package settings, run migrations and add some test data in the oauth_clients and your users tables. Specifically you add client_id and client_secret in the oauth_clients table. Also create a user with username and password in your users table. Finally using POSTMAN chrome extension provide the following data to a POST route to get your access_token.
grant_type as password,
client_id as what you added above,
client_secret as what you just created above,
username your test username,
password your test user password,
You should get correct access_token from POSTMAN.
I think what you need is to include your client_id and secret_id parameters
that you got from github when you created your OAuth application. I use socialite and I had used the following information inside config/services.php
'github' => [
'client_id' => 'CLIENT_ID',
'client_secret' => 'CLIENT_SECRET',
'redirect' => 'REDIRECT_RUL'
]
Of course that's a temporary solution, if you use laravel 5 I suggest you to save this information inside .env files as they are more secure.
More about .env more about socialite