Download the PHP package webiny/login without Composer
On this page you can find all versions of the php package webiny/login. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package login
Short Description Login application that uses Webiny Framework Security component.
License MIT
Homepage http://www.webiny.com/
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package login
Webiny Login
This is an application that provides additional control layer to the Webiny Framework Security component. The application standardizes the login process and user stateless token storage, making it ideal for RESTful and mobile applications.
Some of the built-in features:
- sessions are stored in database and can be revoked at any point
- authorized devices are also stored in database and can be revoked at any point
- login whitelist and blacklist based on client IP
- rate limit control
- stateless login validation for RESTful application
- only whitelisted devices can log-in (optional)
Sample config
- SecurityFirewall: defines which
Security.Firewallto use for user authentication - ValidateDevice: does the device need to be whitelisted before user can login
- BlockThreshold: after how many bad login attempts should the client be blocked from submitting any new login requests (client is identified as username+ip combination)
- BlockTimelimit: for how many minutes should the client be blocked from submitting any additional login attempts
- DeviceTtl: how long should the device session be valid (used only if ValidateDevice is turned on)
- RateLimitBlacklist: list of IPs that are permanently blocked from submitting login requests
- RateLimitWhitelist: list of IPs that are excluded from the rate limit control
Setup
The Login app requires following Webiny Framework components:
Mongo Indexes
Create the following indexes on your Mongo Database:
Example setup:
Once you have the login instance, you can access the methods inside the class directly:
Security setup
Note that the Security component needs to implement Stateless token storage:
Login services
You can use the Login app as a RESTful service by extending the \Webiny\Login\LoginServices abstract class and implementing
it into Webiny Framework Rest component. (view the app/services.php folder for sample implementation)
POST processLogin
This method processes the login request and returns either a login error, or in case of a success, authToken and deviceToken.
The method takes the following parameters via POST:
- username
- password
- authProvider (optional - defines the name of auth provider inside
Security.Firewallthat should be used to process the request) - deviceToken (optional - required only if ValidateDevice is turned on)
Login error codes:
-
- Rate limit reached.
-
- User account is blocked.
-
- Invalid credentials.
-
- User hasn't confirmed his account.
-
- The current device is not on the allowed list.
-
- Either username or password is missing.
POST getDeviceValidationToken
For the provided username, returns deviceValidationToken.
The device validation token is something that can be emailed or sent to the user via SMS or some other form of communication.
The method takes the following parameters via POST:
- username
POST validateDeviceValidationToken
Validates the provided deviceValidationToken for the given username. If the token matches, deviceToken is returned.
This device token needs to be provided to the processLogin method in order to pass the ValidateDevice.
The method takes the following parameters via POST:
- username
- deviceValidationToken
POST getAccountActivationToken
In case users account is not activated, you need to request an activation token. Usually this token is then emailed to the user via an activation link.
The method takes the following parameters via POST:
- username
POST validateAccountActivationToken
Method that validates the provided activation token and either returns a success message, or an error that the token in not valid.
The method takes the following parameters via POST:
- username
- accountActivationToken
POST logout
Invalidates the provided auth token for the given user.
The method takes the following parameters via POST:
- username
- authToken (the auth token returned by processLogin)
POST generateForgotPasswordResetToken
Generates a forgot password link for the given username.
The method takes the following parameters via POST:
- username
What doesn't it do
The Login app doesn't:
- store any cookies or sessions, so all
remember mefeatures need to be done on your end - it doesn't need to know about your users passwords, this is done via the
Securityclass - doesn't email any links like forgot password, activate account, 2FA tokens - login only generates the tokens, the delivery is up to you
- doesn't do any authorization, only authentication
- doesn't provide any visuals, only a class and a RESTful service
