Download the PHP package drewlabs/laravel-http-guard without Composer

Drewlabs Http

Http Guard implementation using oauth bearer token to authenticate request using a remote server.

Note: The package is under active development as the Api can change frequently, refers to the Changelog and the Readme for any changes.

Usage

• Service provider

By default the library is build to inject a service provider in laravel project using the extras flag of composer. By for lumen application, you must register manually the service provider class:

• Configure guard for laravel/lumen project

If the previous section is completed successfully, the http-guard library will try to load basic configurations from the auth.php configuration's file. Add a config/auth.php if missing, and include the following:

Note: In the configuration file above we define the basic configuration required by the package in order to be functional in laravel project.

• Defining the http guard as the default guard

If running in an environment with multiple guard providers, like in laravel framework... Add developper should remember to add the http guard as default guard in the auth.php configuration file.

• Adding protection middleware

Laravel comes with a security middleware that protect routes from unauthorized user. As the laravel setup uses guard, and as the http-guard is build to support laravel security system out of box, developpers can use the default middleware that comes with laravel application if the configuration above are done properly.

But for those looking at creating their own middleware, here is an example implementation:

• Registrering middleware

For laravel application middlewares must be registered in app/Http/Kernel.php file as follow:

For lumen applications:

• Caching

Caching is an important aspect of every application, therefore the http-guard provides a mechanism of verifiying users token even if the authentication or authrrization server is down.

When the authorization server is down the http-guard library try to load users from that cache provider and verify if the issue date of the token is still valid. In case the issue date of the token is still valid, the user is considered as authorized to access application resources, else the guard marks the user as unauthorized.

Therefore the http-guard library provides various caching systems using array storage (in-memory with file dumper), a memcached server storage and a redis storage. Configuration for memcached server are loaded from config/database.php when running laravel or lumen applications. Else the configuration must be defined manually.

Note: The library uses static class properties for configuration values, therefore when manually defining configuration values, remember to centralize the operation in order to run it once per request.

The Example below, define configuration values to be used in the AuthServiceProvider class for laravel / lumen application

-- Using redis as cache driver

As specified in the previous session, the library provide a redis storage provider that depends on predis/predis library. In order to use the redis storage provider, developper must manually install predis/predis. If running in composer environment(recommended), you can install the library as follow:

composer require predis/predis

Next you configure the library to use redis as cache provider as follow:

Note: Predis documentation can be found here [https://github.com/predis/predis]

• Auth server clustering

If your platform configuration support multiple servers for authentication, declare the list of clusters in the config/auth.php[providers[http][hosts][cluster]] map entry.

Note: When running a cluster, developper must provide a background task that call [\Drewlabs\HttpGuard\AuthServerNodesChecker::setAvailableNode()] on a regular basic to update the available node in the cluster in the cache.

• Customization

-- Identity web service routes

By default the guard implementation expect the identity web service to provide api/v2/user and api/v2/logout as routes to resolve the connected user and to revoke the authentication token. But developpers can customize this behavior by:

-- Guard name

By default the library assume the configured guard name is http. Depending on application constraints, developpers may decide to customize the guard name to be used globally. To change the default behavior:

-- User Factory

Building user instance from the request response and validating required inputs can be a tidious task. Therefore, the library provide a default user factory class that build and instance of Drewlabs\Contracts\Auth\Authenticatable::class & \Illuminate\Contracts\Auth\Authenticatable::class from request response body. But the default factory class can be overriden by binding a \Drewlabs\HttpGuard\Contracts\UserFactory into the container or by globally defining the user factory class.

or in the auth.php: