I have created an API which uses JWT to authorise users, and this works great of course.
Some parts of my API need to be accessed without the user logging in. I would call them an anonymous user or public access to the API.
However, there must be some token based authentication, otherwise a malicious user could simply access my api and build their own front-end. I don't want that.
How can I use JWT to authorise a token against something other that the user model AS WELL AS the having user authentication?
And how would I send said token, given that there would be no form submission for these public pages?
Here is an example of my existing JWT auth script, for reference, as i said, I don't want to change this, I want to add some functionality to authenticate my index page, instead of auth'ing a user.
AuthenticateController.php :
...
public function authenticate(Request $request)
{
$credentials = $request->only('email', 'password');
try {
// verify the credentials and create a token for the user
if (! $token = JWTAuth::attempt($credentials)) {
return response()->json(['error' => 'invalid_credentials'], 401);
}
} catch (JWTException $e) {
// something went wrong
return response()->json(['error' => 'could_not_create_token'], 500);
}
// if no errors are encountered we can return a JWT
return response()->json(compact('token'));
}
...
jwt.php (using only user model)
|--------------------------------------------------------------------------
| User Model namespace
|--------------------------------------------------------------------------
|
| Specify the full namespace to your User model.
| e.g. 'Acme\Entities\User'
|
*/
'user' => 'App\User',
/*
|--------------------------------------------------------------------------
| User identifier
|--------------------------------------------------------------------------
|
| Specify a unique property of the user that will be added as the 'sub'
| claim of the token payload.
|
*/
'identifier' => 'user_id',
Any advice of ideas would be appreciated. I'm sorry I haven't got further with this but I'm not sure even on a conceptual level how this would be done! This is my first attempt at an API based app. Thanks.
EDIT: After a bit googling, it seems I want to use JWT to generate and send an API key... but how?
