Chapters

37 Chapters | 3:43:31 |

01

API Docs on Production?

8:22
02

API Tokens? Session Cookies?

8:07
03

API Login Form with json_login

5:36
04

Handling Authentication Errors

3:47
05

On Authentication Success

6:03
06

Logout & Passing API Data to JavaScript

5:45
07

Passing Values to Stimulus

4:32
08

Token Types & The ApiToken Entity

5:59
09

Generating the API Token & Fixtures

5:58
10

Access Token Authenticator

8:56
11

Customizing the OpenAPI Docs

7:31
12

API Token Scopes

5:51
13

Deny Access with The "security" Option

7:11
14

Bootstrapping a Killer Test System

8:18
15

JSON Test Assertions & Seeding the Database

3:41
16

Advanced & Flexible JSON Test Assertions

4:04
17

Testing Authentication

4:59
18

Customizing Browser Globally

3:50
19

Testing Token Authentication

3:24
20

New PUT Behavior

4:46
21

Only Allow Owners to Edit

7:49
22

Allow Admin Users to Edit any Treasure

4:11
23

Security Voter

6:13
24

Conditional Fields by User: ApiProperty

5:13
25

User Test + Plain Password

4:21
26

State Processors: Hashing the User Password

6:55
27

Validation Groups & Patch Formats

8:01
28

Dynamic Groups: Context Builder

8:26
29

Custom Normalizer

5:08
30

Normalizer Decoration & "Normalizer Aware"

6:29
31

Totally Custom Fields

3:24
32

Custom Validator

7:58
33

Validating how Values Change

8:30
34

Auto Setting the "owner"

4:19
35

Query Extension: Auto-Filter a Collection

6:15
36

404 On Unpublished Items

8:00
37

Filtering Relation Collection

5:39

> APIs > API Platform 3 Part 2: Security for your Treasures

Buy Access to Course

10.

Access Token Authenticator

|

|

Autoplay

Previous Chapter

Next Challenge

Login or register to check out the script

19 Comments

Sort By

Login or Register to join the conversation

Rodrypaladin 1 year ago edited

Hello machines! After finishing the course I'm trying to add the authenticator to coexist with another one I already had in the project where I'm trying to implement the api. But it seems that something doesn't work, well

This is the security.yaml file:

security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
    role_hierarchy:
        ROLE_FULL_USER: [ ROLE_USER_EDIT, ROLE_TREASURE_CREATE, ROLE_TREASURE_EDIT ]

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            lazy: true
            provider: app_user_provider
            custom_authenticator: App\Security\LoginAuthenticator
            logout:
                path: app_logout
                target: app_login
                # where to redirect after logout
                # target: app_any_route
            login_throttling:
                limiter: app.login_rate_limiter

            remember_me:
                secret: '%kernel.secret%'
                #lifetime: 604800
                path: /
                # by default, the feature is enabled by checking a checkbox in the
                # login form, uncomment the following line to always enable it.
                #always_remember_me: true

        api:
            pattern: ^/api
            stateless: true
            provider: app_user_provider
            access_token:
                token_handler: App\Security\ApiTokenHandler




            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#the-firewall

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true


    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/admin, roles: ROLE_ADMIN }
        # - { path: ^/profile, roles: ROLE_USER }

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon

If I don't put ROLE requirement in api resource, it makes the query and returns fine, but when I put for example that I need ROLE_ADMIN, or any other role, the response is a code 200 and returns the login template that my project has, in this case the LoginAuthenticator.

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Log in!</title>
    <link rel="icon"
          href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 128 128%22><text y=%221.2em%22 font-size=%2296%22>⚫️</text><text y=%221.3em%22 x=%220.2em%22 font-size=%2276%22 fill=%22%23fff%22>sf</text></svg>">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap"
          rel="stylesheet">

            <link rel="stylesheet" href="/build/app.790d8e09.css">

How can I make these two logins coexist?

That the LoginAuthenticator that my project already had should use sessions and the API one should not use them with stateless: true and use the ApiTokenHandler that was made in the course.

|

Rodrypaladin 1 year ago edited

As far as I'm following the course right now it works fine except for one detail.

When I put in the authentication ‘Bearer asasassa’ the invalid key error appears perfectly, and if I put a correct Bearer it makes the request correctly, but if I don't put any Bearer it also returns the data.

But if I don't set any Bearer it returns the data too, shouldn't it say that there is no api key or that it is not correct?

|

weaverryan SFCASTS Rodrypaladin 1 year ago edited

Hey @Rodrypaladin!

That's actually a great question! When you send with no Bearer, to Symfony, this simply looks like a request that is not trying to send authentication info. The token isn't wrong, there just is no token. The result is that the request is basically "anonymous" / not logged in. If the endpoint that's reached does not require auth, the endpoint will return the real data. If the endpoint does require auth, then it should reject the request with a 401 Unauthorized.

Let me know if that clarifies.

Cheers!

|

sujal_k 1 year ago edited

I see this error:
and it works if we do stateless: true,
so in Symfony 7, is this how it works ?
When I authorize using token ( I'm using Symfony 7 ), then it throws following error, but can't we just run session app and API at the same time in Symfony like you're doing in this lecture ?

{
  "@id": "/api/errors",
  "@type": "hydra:Error",
  "title": "An error occurred",
  "detail": "Session was used while the request was declared stateless.",
  "status": 500,
}

|

weaverryan SFCASTS sujal_k 1 year ago edited

Hey @sujal_k!

Sorry for the slow reply! To make sure I understand: you need to run a normal session-based security app and a stateless, API token version at the same time? Can you explain the requirements a bit more, that'll help me with a better answer.

Cheers! And sorry to not offer any useful info yet!

|

ToNy 2 years ago edited

When I log out and try to use the token to log in in the authorization button. It doesn't log me in, when I go to security in the profiler, it says "There is no security token.". Even if the token is not valid, I still get a 200 with the data.

I think I followed the steps correctly, any ideas?

|

winaruz ToNy 2 years ago

Heyy!!

I have the same problem,

i did the same config, and i'm alawys getting a 200 response (with valid or not token plus without Authorization header param)
But when i comment the lazy config i still get a 200 if not Authorization passed in header, and 401 if no valid token

1 |

Twigsee winaruz 2 years ago edited

Hi, I experience the same behavior. It seems something is missing in the video...
Can anyone help, please?
@MolloKhan ?

|

MolloKhan SFCASTS Twigsee 2 years ago edited

Hey @Twigsee

Sorry for my late reply. I have the same question as here https://symfonycasts.com/screencast/api-platform-security/access-token-authenticator#comment-31679
I believe your authenticator might be misconfigured, let's debug that first

Cheers!

|

Teddy-B MolloKhan 1 year ago edited

I am using Caddy, and having the same issue with loggin in,
When I try to authenticate/ login,
I get a "There is no security token." in my profiler >> security
Does "SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1" this work for Caddy users as well,
I dont know where to put this as I dont have .htaccess file

|

MolloKhan SFCASTS Teddy-B 1 year ago edited

Hey @Teddy-B

I've not worked with Caddy yet so I don't know how to make it work. Have you asked ChatGPT or any other AI? You may be surprised of how good they are for this kind of problem

Cheers!

|

Teddy-B MolloKhan 1 year ago

Thanks I have heard of ChatGPT never thozght it was something I really wanted to use, but I was indeed impressed with the ansers, I havent solved the issue yet, but I think I am close, I guess I just ask around at stackoverflow then.

Thanks for you quick reply Though!

|

Teddy-B Teddy-B 1 year ago

I figured out I just had to add Content-Type: application -json on the headers and got it working... cant believe it

|

MolloKhan SFCASTS Teddy-B 1 year ago

Ha! So it was not the web server. I thought ApiPlatform adds that header automatically for you but I think Symfony short-circuits the workflow when you try to log in

Thanks for sharing!

|

Teddy-B MolloKhan 1 year ago edited

I think becaue I am using CORS, intergrating 2 appliciations. I got docker setup and the frontend (React) is seperated from the Backend (Symsony)

|

MolloKhan SFCASTS ToNy 2 years ago edited

Hey @ToNy

Can you see in the profiler the security process kicking in? I think your authenticator is not been called for some reason.

1 |

ToNy MolloKhan 2 years ago

I had my apache misconfigured. I solved with the (in)famous:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

Thanks for your reply.

1 |

Ange-B 3 years ago

Hi !

This example shows how to get User when JWT TOKENs are stored in database.

I'm using LexikJWTAuthenticationBundle. Users are not stored in database.
I want to retrieve Connected User when making request with the generated TOKEN.
How can i do this with class ApiTokenHandler ?

Please help me ! Thanks You

|

sadikoff Ange-B 3 years ago

Hi @Ange-B,

Can you give more context? Where exactly do you want to get User info?

IIRC if you are using LexikJWTAuthenticationBundle it already stores the user info in symfony security system, so it can be easily accessed from anywhere, all you need is ~~love~~ autowire Security class from Security bundle and use $this->security->getUser() method to get current authenticated user

PS maybe I'm missing something so waiting for your feedback

Cheers!

|

API Platform 3 Symfony 6.2

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^3.0", // v3.1.2
        "doctrine/annotations": "^2.0", // 2.0.1
        "doctrine/doctrine-bundle": "^2.8", // 2.8.3
        "doctrine/doctrine-migrations-bundle": "^3.2", // 3.2.2
        "doctrine/orm": "^2.14", // 2.14.1
        "nelmio/cors-bundle": "^2.2", // 2.2.0
        "nesbot/carbon": "^2.64", // 2.66.0
        "phpdocumentor/reflection-docblock": "^5.3", // 5.3.0
        "phpstan/phpdoc-parser": "^1.15", // 1.16.1
        "symfony/asset": "6.2.*", // v6.2.5
        "symfony/console": "6.2.*", // v6.2.5
        "symfony/dotenv": "6.2.*", // v6.2.5
        "symfony/expression-language": "6.2.*", // v6.2.5
        "symfony/flex": "^2", // v2.2.4
        "symfony/framework-bundle": "6.2.*", // v6.2.5
        "symfony/property-access": "6.2.*", // v6.2.5
        "symfony/property-info": "6.2.*", // v6.2.5
        "symfony/runtime": "6.2.*", // v6.2.5
        "symfony/security-bundle": "6.2.*", // v6.2.6
        "symfony/serializer": "6.2.*", // v6.2.5
        "symfony/twig-bundle": "6.2.*", // v6.2.5
        "symfony/ux-react": "^2.6", // v2.7.1
        "symfony/ux-vue": "^2.7", // v2.7.1
        "symfony/validator": "6.2.*", // v6.2.5
        "symfony/webpack-encore-bundle": "^1.16", // v1.16.1
        "symfony/yaml": "6.2.*" // v6.2.5
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.4", // 3.4.2
        "mtdowling/jmespath.php": "^2.6", // 2.6.1
        "phpunit/phpunit": "^9.5", // 9.6.3
        "symfony/browser-kit": "6.2.*", // v6.2.5
        "symfony/css-selector": "6.2.*", // v6.2.5
        "symfony/debug-bundle": "6.2.*", // v6.2.5
        "symfony/maker-bundle": "^1.48", // v1.48.0
        "symfony/monolog-bundle": "^3.0", // v3.8.0
        "symfony/phpunit-bridge": "^6.2", // v6.2.5
        "symfony/stopwatch": "6.2.*", // v6.2.5
        "symfony/web-profiler-bundle": "6.2.*", // v6.2.5
        "zenstruck/browser": "^1.2", // v1.2.0
        "zenstruck/foundry": "^1.26" // v1.28.0
    }
}

Previous Chapter

Next Challenge