I have the following code:
Route::get('/', function()
{
return 'non secure page';
});
Route::get('/', array('https' => true, function()
{
return 'secure page';
}));
What I expected to happen is that these two routes would be treated differently. The first is for http://example.com requests and the second for https://example.com. Respectively, these pages should show the text 'non secure page' and 'secure page'. What actually happens is that both show the text 'secure page'. This must mean that both routes are treated the same i.e. it doesn't matter if the request was over https or http - the same route is triggered.
I know I can resolve my issue by using if (Request::secure()){ //routes }; but that then leads me to the question what use are the HTTPS secure routes in laravel? What do they achieve and when should they be used?
I've looked at the docs, but it's not clear to me what is supposed to happen.
The documentation says:
When defining routes, you may use the "https" attribute to indicate that the HTTPS protocol should be used when generating a URL or Redirect to that route.
"https" and ::secure() are only used when generating URLs to routes, they're not used to provide https-only routes. You could write a filter to protect against non-HTTPS routes (example below). Or if you want to prevent any non-HTTPS access to your entire domain then you should reconfigure your server, rather than do this in PHP.
Route::filter('https', function() {
if (!Request::secure()) return Response::error(404);
});
Alternative filter response:
Route::filter('https', function() {
if (!Request::secure()) return Redirect::to_secure(URI::current());
});
References:
http://laravel.com/docs/routing#https-routes
http://laravel.com/docs/routing#filters
The problem is not related to HTTPS.
The documentation says,
Note: Routes are evaluated in the order that they are registered, so register any "catch-all" routes at the bottom of your routes.php file.
It means that your
Route::get('/', array('https' => true, function()
{
return 'secure page';
}));
is over-writing
Route::get('/', function()
{
return 'non secure page';
});
I was actually lead here by Spark from laravel.io and I thought I would clarify the doubt anyhow.
Regards
Related
location #laravelapi {
rewrite /api/(.*)?$ /api/index.php?$is_args$args last;
}
When we try access to api/routeexample, laravel gets only routeexample part, and throws 404 error. How we can send full url including 'api' part?
I m adding an example of how we define route for API request:
In routes/api.php
Route::group(['prefix' => 'v1'], function () {
Route::post('api_request', [App\Http\Controllers\YourController::class, 'targeted_function_name'])->name('api_request');
});
So I'm just added
include "api.php";
into my routes/web.php as hotfix, but i will search for better solution
I have https://tenancyforlaravel.com/ installed in laravel to make multi-tenant and it works fine for the web routes.
My problem is that when I access my APIs then I get a 404 error in tenant domains.
tenancyforlaravel documentation: https://tenancyforlaravel.com/docs/v3/routes
It says that I must put all my APIs inside api.php file and wrap them in a Route group with this middleware so I put all my APIs inside api.php file and all my APIs as below:
Route::middleware('tenancy')->group(function () {
Route::name('api.')->namespace('Api')->group(function () {
Route::post('/login', 'AuthController#login')->name('login');
...
});
and when I access it using sub.local.test/api/login then I get 404 error.
Tested for tenancyforlaravel.com V3 and it works OK.
Route::middleware([
InitializeTenancyByDomain::class,
PreventAccessFromCentralDomains::class
])->prefix('api')->group(function () {
//
Route::name('api.')->namespace('App\Http\Controllers\Api')->group(function () {
Route::post('/login', 'AuthController#login')->name('login');
...
});
Put all your API routes inside api.php as below
use App\Http\Controllers\AuthController;
Route::group(['prefix' => '/{tenant}',
'middleware' => [InitializeTenancyByPath::class],],
function () {
Route::post('/login', [AuthController::class, 'login'])->name('login');
...
});
As you haven't mentioned your tenant identifier, I am using path as identifier, so using InitializeTenancyByPath middleware. Use whatever identifier middleware you want in place of that.
Access your API routes normally as you used to do, with your identifier. As this example uses path as identifier, the endpoint will look like:
sub.local.test/api/{tenant}/login
I've got a question regarding Laravel framework (vers. 5.2) and the authentication. I have 2 domains which represent a software. let's call them https://azure.mydomain.com and https://azuresoftware.mydomain.com.
The Laravel application is hosted on the domain https://azuresoftware.mydomain.com. https://azure.mydomain.com is just a CMS framework which is providing some information about the website.
Now I want to display different menus, if the user is logged in or not on https://azure.mydomain.com. I thought, I can do a fetch request to https://azuresoftware.mydomain.com/ and use the Laravel methods Auth::check() to check if the user is already logged in or not. I know that this is a CORS fetch request, but this is not the issue. I've allowed in the IIS webserver requests from https://azure.mydomain.com. The request works fine and also just a simple request. But actually Auth::check() is always returning false, even when I'm logged in on the software side.
This is my code so far:
<script>
fetch('https://azuresoftware.mydomain.com/checkLogin', {
method: 'GET',
headers: {
'Content-Type': 'text/plain'
}
})
.then(function(res) {
return res.json()
})
.then(function(data) {
if(data.isLoggedIn) {
// do some stuff...
}
else
{
// do some other stuff...
}
});
</script>
routes.php:
Route::group(['middleware' => 'web'], function () {
...
Route::get('checkLogin', function() {
return json_encode(['isLoggedIn'=>\Auth::check()]);
});
...
I'm sure, I forgot something essential, why it is not working this way.
This is due to the fact that AJAX calls only send cookies if the url you're calling is on the same domain as your calling script.
See Cross domain POST request is not sending cookie Ajax Jquery for more information.
I have a situation. I am trying to create an application that will have only one route file, api.php for both the web app (spa) and mobile app.The problem is now that the entire application is stateless (as it should be), I can't even login. Because, routes in api.php expect a token in the request header, which I don't know how to provide.I am using vue in the front-end I have this simple strategy:<button #click="login">Login</button>and the login method looks like this:
login(){
axios.post('login',this.credentials)
.then( window.location = "http://localhost:3000/app" );
}
And my route definition:
Route::group(['middleware' => ['role:admin']], function () {
Route::get('app', function () {
return view('index');
});
});
But it redirects me back to the login page. I wish I could do something like window.header = Bearer myLongToken. I am using JWT, if that helps.
Update:
It looks like there is something else going on. If I remove the role:admin middleware, then I get redirected to desired route, but if I add the middleware, I get redirected back to the login route even if the credentials are valid.
// Route::group(['middleware' => ['role:admin']], function () {
Route::get('app', function () {
return view('index');
});
// });
I have installed Laravel Passport and configured it according to the documentation. When calling axios.get from my VueJS file, the first call works as expected. the laravel_session Request Cookie is injected into the request, and the authentication passes, returning the resource.
My problem arises when I try to call the axios.get method again. My use case here is a search function. I'm making a call to /api/banking/accounts/search/{search-term} whenever the user types into a text field, using the code below:
remoteMethod(query) {
if (query !== '') {
this.loading = true;
axios.get(
`/api/banking/accounts/search/${escape(query)}`
).then(res => {
this.destinationAccountDirectory = res.data;
this.loading = false;
});
} else {
this.destinationAccountDirectory = [];
}
},
This code works fine without any auth:api middleware on the route, and for the first time with auth:api middleware. As can be seen from the screenshots below, the laravel_token value changes and is rejected on subsequent calls to the API.
**I've tried to removed the \Laravel\Passport\Http\Middleware\CreateFreshApiToken that was added to the web middleware group during passport installation, which seemed to have temporarily solved the issue, until I receive a 419 on a request shortly after. What could be causing the new laravel_tokens to be rejected? **
I solved this by removing the web middleware from my API route. Why it was there in the first place, I have no idea.
I changed my api.php from
Route::group([
'middleware' => [
'web',
'auth:api']], function() {
Route::post('/banking/transactions', 'TransactionController#store');
Route::get('/banking/accounts', 'BankAccountDirectoryController#index');
Route::get('/accounts/{account}', 'BankAccountDirectoryController#show');
Route::get('/banking/accounts/search/{term?}', 'BankAccountDirectoryController#search');
});
to
Route::group([
'middleware' => [
'auth:api']], function() {
Route::post('/banking/transactions', 'TransactionController#store');
Route::get('/banking/accounts', 'BankAccountDirectoryController#index');
Route::get('/accounts/{account}', 'BankAccountDirectoryController#show');
Route::get('/banking/accounts/search/{term?}', 'BankAccountDirectoryController#search');
});
Should the API routes be under the web group to benefit from the middleware, or is it purely for UI? Am I safe to do this?