3

First, let me describe the application: we are working on a web-based software which is some kind of custom help desk application. It requires the user to login (we use FOSUserBundle). After login the user is redirected to the dashboard. From the dashboard there is no more page reload, the frontend is build on Angularjs and the user can get anywhere within the application without page reload. You could speak of a single page application.

So the data that is presented to the user, is fetched from a rest api (we use FOSRestBundle). This works quite well at this point.

There is some kind of dilemma. Only our staff will access this application (for now). So a staff member needs to login to access the helpdesk. The data that is pushed to the frontend via angularjs is called via api, so the user that has just logged in needs to authenticate again on every request because of rest.

Problem: Since the backend runs on symfony2 let us just try to get the user object of the currently logged in user when an api call is made:

$this->get('security.context')->getToken()->getUser()

returns anon. that stands for anonymous, or

$this->getUser();

returns just null.

So the authenticated context seems to be gone when using the rest api. However when I call an action directly without rest, I can get user information.

So what we need is to secure our rest api and get user information on every api call. We don't want third party people to access our application, just staff. I am not familar with OAuth, but the user will be redirected to a third party page to Allow/Deny access to his data? This would not be an option for us.

Based on that information, do you have any suggestions or ideas how to secure the api and transport the user data so that getUser does not return null or anon. but the actuall logged in user?

DarkLeafyGreen
  • 69,338
  • 131
  • 383
  • 601
  • hard to guess what's wrong ... it is certainly a bug in your code or the firewall misconfigured ... but without seeing any code shown , how can one know ? – mpm Apr 25 '13 at 22:06

3 Answers3

3

there's another way to resolve your problem.

It's by using Certificates. you can generate certificates then use Http tunneling (https obviousley), the server will ask for a certificate (you've to configure Apache for that but it's not a big challenge).

with this in place, you've to add a CertificateManageron the server side to ensure that the certificate is valid and to know who's calling the service (to be able to authenticate the user at each request), the CertificateManager(or what ever you'll call it) will probably have to be configured within you filters chaine (as known in the java world), et voilà

Hop that help you, Abderrazak

Abderrazak BOUADMA
  • 1,526
  • 2
  • 16
  • 38
1

REST is stateless so you will have to send some kind of authentication/authorization in each request. You can use HTTP BASIC AUTH or something like OAuth.

Have a look at https://github.com/FriendsOfSymfony/FOSOAuthServerBundle

I'm kind of building our application in exactly the same architecture (RESTful API with Symfony2 back-end and AngularJS frontend.

Simon
  • 1,643
  • 7
  • 30
  • 61
  • 1
    +1 for OAuth hint. However for now we don't want to expose our api for third party clients, so dealing with OAuth might be an overkill here. Because the user accessing the application at the same time would be the client too. I am going to extend my question a bit. – DarkLeafyGreen Apr 26 '13 at 07:18
  • 1
    if the api is used by javascript coming from the same server you dont need openauth. You can use sessions to check if the user is authenticated or not , if not you need a least a token system after the authentication for authorization. – mpm Apr 26 '13 at 08:38
  • @mpm Sounds promising. Can you post this as answer and extend it a bit, how can Fosuserbundle+Session instead of cookie help me with my problem? – DarkLeafyGreen Apr 26 '13 at 10:34
0

Another way is to duplicate the api routes, so that you have the api routes protected by OAUTH and the api routes protected by the session, both of them pointing to the same controllers. The method was explained here: https://stackoverflow.com/a/22964736/435026

Community
  • 1
  • 1
fdellutri
  • 963
  • 1
  • 7
  • 16