These are the basic functions of the driver user.
public function authenticate(Request $request){
$credentials=$request->only('email','password');
try {
\Config::set('auth.providers.users.model', \App\Driver::class);
\Config::set('auth.providers.users.table', 'drivers');
\Config::set('jwt.user', \App\Driver::class);
if (!$token =JWTAuth::attempt($credentials)) {
return response()->json(['error'=>'Invalid_Crendals'],401);
}
} catch (JWTException $e) {
return response()->json(['error' => 'could_not_create_token'], 500);
}
return response()->json(['token Login Driver'=>compact('token'),'msg'=>'driver']);
}
public function register(){
$email=request()->email;
$name=request()->name;
$last=request()->last;
$password=request()->password;
$driver=Driver::create([
'name'=>$name,
'email'=>$email,
'last'=>$last,
'password'=>bcrypt($password),
]);
\Config::set('auth.providers.users.model', \App\Driver::class);
\Config::set('auth.providers.users.table', 'drivers');
\Config::set('jwt.user', \App\Driver::class);
$token=JWTAuth::fromUser($driver);
return response()->json(['token Driver'=>$token],200);
}
public function testd(){
try {
\Config::set('auth.providers.users.model', \App\Driver::class);
\Config::set('auth.providers.users.table', 'drivers');
\Config::set('jwt.user', \App\Driver::class);
$token=JWTAuth::getToken();
$driver=JWTAuth::toUser($token);
} catch (JWTException $e) {
return response()->json(['error' => 'could_not_create_token'], 500);
}
return response()->json($driver);
}
These are the conventional user functions
public function authenticate(Request $request){
$credentials=$request->only('email','password');
try {
\Config::set('auth.providers.users.model', \App\User::class);
\Config::set('auth.providers.users.table', 'users');
\Config::set('jwt.user', \App\User::class);
if (!$token =JWTAuth::attempt($credentials)) {
return response()->json(['error'=>'Invalid_Crendals'],401);
}
} catch (JWTException $e) {
return response()->json(['error' => 'could_not_create_token'], 500);
}
return response()->json(['toke Login User'=>compact('token'),'msg'=>'User Register']);
}
public function register(){
$email=request()->email;
$name=request()->name;
$password=request()->password;
$user=User::create([
'name'=>$name,
'email'=>$email,
'password'=>bcrypt($password),
]);
\Config::set('auth.providers.users.model', \App\User::class);
\Config::set('auth.providers.users.table', 'users');
\Config::set('jwt.user', \App\User::class);
$token=JWTAuth::fromUser($user);
return response()->json(['token'=>$token],200);
}
public function testd(){
try {
\Config::set('auth.providers.users.model', \App\User::class);
\Config::set('auth.providers.users.table', 'users');
\Config::set('jwt.user', \App\User::class);
$token=JWTAuth::getToken();
$driver=JWTAuth::toUser($token);
} catch (JWTException $e) {
return response()->json(['error' => 'could_not__User_create_token'], 500);
}
return response()->json($driver);
}
And used a middleware for each one This is for the driver user
public function handle($request, Closure $next)
{
try {
Config::set('jwt.user','App\Driver');
Config::set('auth.providers.users.model', \App\Driver::class);
$user=JWTAuth::parseToken()->authenticate();
if (! $user) {
return response()->json(['user_not_found'], 404);
}
} catch (Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
return response()->json(['token_expired'], $e->getStatusCode());
} catch (Tymon\JWTAuth\Exceptions\TokenInvalidException $e) {
return response()->json(['token_invalid'], $e->getStatusCode());
} catch (Tymon\JWTAuth\Exceptions\JWTException $e) {
return response()->json(['token_absent'], $e->getStatusCode());
}
return $next($request);
}
And for the conventional user
try {
Config::set('jwt.user','App\User');
Config::set('auth.providers.users.model', \App\User::class);
if (! $user = JWTAuth::parseToken()->authenticate()) {
return response()->json(['user_not_found'], 404);
}
} catch (Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
return response()->json(['token_expired'], $e->getStatusCode());
} catch (Tymon\JWTAuth\Exceptions\TokenInvalidException $e) {
return response()->json(['token_invalid'], $e->getStatusCode());
} catch (Tymon\JWTAuth\Exceptions\JWTException $e) {
return response()->json(['token_absent'], $e->getStatusCode());
}
return $next($request);
}
File App.php
Route::post('authenticate','Api\UserController@authenticate');
Route::post('register','Api\UserController@register');
Route::post('authenticate/driver','Api\DriverController@authenticate');
Route::post('register/driver','Api\DriverController@register');
Route::post('test/driver','Api\DriverController@testd')->middleware('driver');
Route::post('test/user','Api\UserController@testd')->middleware('user');
Users are authenticated and register well in their corresponding tables The problem I encounter is the following, When I use the generated token when registering a user Driver and I use this same token to access the route test / user where by logic this does not owe me To show no result since it is an incorrect token generated by another user, this same token enters the function and shows me the data of a conventional user. How can I solve this security problem? The truth has been many days and I have not been able to solve it.
