Here's my route:
Route::controller('/site-manager-gateway', 'SiteManagerGatewayController');
How can I apply a CSRF filter and Auth filter, I've tried adding them like:
Route::controller('/site-manager-gateway', 'SiteManagerGatewayController', array('before' => 'auth' | 'csrf'));
But no luck.
You can wrap multiple controllers/actions in a group, and apply filter for whole group. I think this is best practice, as you don't have to repeat yourself on each route.
Also, you have to specify filters in string
'filterA|filterB'
not
'filterA' | 'filterB'
So the router looks like:
Route::group(array('before' => 'auth|csrf'), function()
{
Route::controller('/site-manager-gateway', 'SiteManagerGatewayController');
});
Check out http://laravel.com/docs/routing#route-filters and check out "Attaching multiple routes to a filter"
Route::get('user', array('before' => 'auth|old', function()
{
return 'You are authenticated and over 200 years old!';
}));
By looking at your code you separated the auth and csrf with single quotes when they should be placed together so instead of 'auth' | 'csrf' you need 'auth | csrf'.
Related
I have https://tenancyforlaravel.com/ installed in laravel to make multi-tenant and it works fine for the web routes.
My problem is that when I access my APIs then I get a 404 error in tenant domains.
tenancyforlaravel documentation: https://tenancyforlaravel.com/docs/v3/routes
It says that I must put all my APIs inside api.php file and wrap them in a Route group with this middleware so I put all my APIs inside api.php file and all my APIs as below:
Route::middleware('tenancy')->group(function () {
Route::name('api.')->namespace('Api')->group(function () {
Route::post('/login', 'AuthController#login')->name('login');
...
});
and when I access it using sub.local.test/api/login then I get 404 error.
Tested for tenancyforlaravel.com V3 and it works OK.
Route::middleware([
InitializeTenancyByDomain::class,
PreventAccessFromCentralDomains::class
])->prefix('api')->group(function () {
//
Route::name('api.')->namespace('App\Http\Controllers\Api')->group(function () {
Route::post('/login', 'AuthController#login')->name('login');
...
});
Put all your API routes inside api.php as below
use App\Http\Controllers\AuthController;
Route::group(['prefix' => '/{tenant}',
'middleware' => [InitializeTenancyByPath::class],],
function () {
Route::post('/login', [AuthController::class, 'login'])->name('login');
...
});
As you haven't mentioned your tenant identifier, I am using path as identifier, so using InitializeTenancyByPath middleware. Use whatever identifier middleware you want in place of that.
Access your API routes normally as you used to do, with your identifier. As this example uses path as identifier, the endpoint will look like:
sub.local.test/api/{tenant}/login
I have installed Laravel Passport and configured it according to the documentation. When calling axios.get from my VueJS file, the first call works as expected. the laravel_session Request Cookie is injected into the request, and the authentication passes, returning the resource.
My problem arises when I try to call the axios.get method again. My use case here is a search function. I'm making a call to /api/banking/accounts/search/{search-term} whenever the user types into a text field, using the code below:
remoteMethod(query) {
if (query !== '') {
this.loading = true;
axios.get(
`/api/banking/accounts/search/${escape(query)}`
).then(res => {
this.destinationAccountDirectory = res.data;
this.loading = false;
});
} else {
this.destinationAccountDirectory = [];
}
},
This code works fine without any auth:api middleware on the route, and for the first time with auth:api middleware. As can be seen from the screenshots below, the laravel_token value changes and is rejected on subsequent calls to the API.
**I've tried to removed the \Laravel\Passport\Http\Middleware\CreateFreshApiToken that was added to the web middleware group during passport installation, which seemed to have temporarily solved the issue, until I receive a 419 on a request shortly after. What could be causing the new laravel_tokens to be rejected? **
I solved this by removing the web middleware from my API route. Why it was there in the first place, I have no idea.
I changed my api.php from
Route::group([
'middleware' => [
'web',
'auth:api']], function() {
Route::post('/banking/transactions', 'TransactionController#store');
Route::get('/banking/accounts', 'BankAccountDirectoryController#index');
Route::get('/accounts/{account}', 'BankAccountDirectoryController#show');
Route::get('/banking/accounts/search/{term?}', 'BankAccountDirectoryController#search');
});
to
Route::group([
'middleware' => [
'auth:api']], function() {
Route::post('/banking/transactions', 'TransactionController#store');
Route::get('/banking/accounts', 'BankAccountDirectoryController#index');
Route::get('/accounts/{account}', 'BankAccountDirectoryController#show');
Route::get('/banking/accounts/search/{term?}', 'BankAccountDirectoryController#search');
});
Should the API routes be under the web group to benefit from the middleware, or is it purely for UI? Am I safe to do this?
How to correct? That's all intertwined url?
/admin/* (if auth and id user **!=** 1 redirect '/')
/admin/* (if **NO** auth redirect '/admin/login')
/admin/{page} (if auth and id user **==** 1) redirect /admin/{page}
Make a Route Group which you can call admin and and create the confirmation, then add a prefix to the route for example:
Route::group(array('prefix' => 'admin'), function()
{
Route::get('user', function()
{
// place your routes here
});
});
Reference
In my front end I have a collection of models. Each collection can communicate with the back end and each model can also communicate with the back end.
I am trying to devise the proper url routes for it here is what I am thinking
create [POST] /mycollection
update [PATCH] /mycollection/22
delete [DELETE] /mycollection/22
and for the models
create [POST] /mycollection/22
update [PATCH] /mycollection/22/3
delete [DELETE] /mycollection/22/3
How should I create my routes in Laravel?
I'm looking into route groups but it's still quite a bit of boiler plate it seems.
Route::group(array('prefix' => 'mycollection'), function()
{
Route::get('{id}', function($id){});
Route::post('/', function(){});
Route::patch('{id}', function($id){});
Route::destroy('{id}', function($id){});
Route::get('{id}/{child_id}', function($id, $child_id){});
Route::post('{id}', function($id){});
Route::patch('{id}/{child_id}', function($id, $child_id){});
Route::destroy('{id}/{child_id}', function($id, $child_id){});
});
What you are looking for is RESTful resource routes with Laravel. You can read more here
Route::group(array('prefix' => 'mycollection'), function()
{
Route::resource('/', 'CollectionController#index');
});
I have the following code:
Route::get('/', function()
{
return 'non secure page';
});
Route::get('/', array('https' => true, function()
{
return 'secure page';
}));
What I expected to happen is that these two routes would be treated differently. The first is for http://example.com requests and the second for https://example.com. Respectively, these pages should show the text 'non secure page' and 'secure page'. What actually happens is that both show the text 'secure page'. This must mean that both routes are treated the same i.e. it doesn't matter if the request was over https or http - the same route is triggered.
I know I can resolve my issue by using if (Request::secure()){ //routes }; but that then leads me to the question what use are the HTTPS secure routes in laravel? What do they achieve and when should they be used?
I've looked at the docs, but it's not clear to me what is supposed to happen.
The documentation says:
When defining routes, you may use the "https" attribute to indicate that the HTTPS protocol should be used when generating a URL or Redirect to that route.
"https" and ::secure() are only used when generating URLs to routes, they're not used to provide https-only routes. You could write a filter to protect against non-HTTPS routes (example below). Or if you want to prevent any non-HTTPS access to your entire domain then you should reconfigure your server, rather than do this in PHP.
Route::filter('https', function() {
if (!Request::secure()) return Response::error(404);
});
Alternative filter response:
Route::filter('https', function() {
if (!Request::secure()) return Redirect::to_secure(URI::current());
});
References:
http://laravel.com/docs/routing#https-routes
http://laravel.com/docs/routing#filters
The problem is not related to HTTPS.
The documentation says,
Note: Routes are evaluated in the order that they are registered, so register any "catch-all" routes at the bottom of your routes.php file.
It means that your
Route::get('/', array('https' => true, function()
{
return 'secure page';
}));
is over-writing
Route::get('/', function()
{
return 'non secure page';
});
I was actually lead here by Spark from laravel.io and I thought I would clarify the doubt anyhow.
Regards