Testing Token Authentication

Hey @Rodrypaladin ,

I see in this chapter we allow application/json content type as well along with application/ld+json. Probably your config is different? Anyway, thanks for this tip!

Cheers!

I don't know if my configuration is different. I only know that from the very first moment following the course, in the Patch applications I have had to incorporate it if necessary.

The important thing is that I was able to solve it by my own means.

Hey @Rodrypaladin ,

Good catch on solving this yourself 👍

Cheers!

Hey @NinjaScareCrow ,

Hm, if your database is truncated between tests but somehow the entity manager isn't cleared, Doctrine might still hold references to old entities in memory. You can try to clear the entity manager manually in the beginning of your test, or in the setUp() method called before each test, something like this:

protected function setUp(): void
{
    parent::setUp();
    $this->entityManager = self::$container->get('doctrine')->getManager();
    $this->entityManager->clear(); // Clears the EntityManager before each test
}

I wonder if it helps with that test failure.

Cheers!

Hey Victor

Unfortunately that didn't work :(
I had to adapt it slightly as self::$container doesn't exist.

protected function setUp(): void
{
    parent::setUp();
    $this->entityManager = self::bootKernel()->getContainer()->get('doctrine')->getManager();
    $this->entityManager->clear();
}

I'm still getting the same error on the second test when I rull all the tests using symfony php bin/phpunit.
I even tried getting the entity manager and clearing it at the beginning of the test cases, but that also didn't work.

Any other ideas? ;)

Hey @NinjaScareCrow

How are you restoring your database after each test? Are you using the dama bundle?

Cheers!

Hey @TristanoMilano!

Sorry for my super slow reply! Hmm, this is tricky. Here's what I can tell you:

• The ->actingAs() method from browser is a wrapper around the ->loginUser() method of Symfony - https://github.com/symfony/symfony/blob/9e810dea50cb47deb8500ad7ffb56d5a5622b46e/src/Symfony/Bundle/FrameworkBundle/KernelBrowser.php#L103
• When you pass that a user, it creates its own TestBrowserToken object - https://github.com/symfony/symfony/blob/9e810dea50cb47deb8500ad7ffb56d5a5622b46e/src/Symfony/Bundle/FrameworkBundle/KernelBrowser.php#L113

So, it may be that simple. Your user is getting logged in, but instead of a PostAuthenticationToken with this profileUrl set, it's a TestBrowserToken with no attribute set.

If that's true, you may need to write your own fake authentication logic in your test that mimics the loginUser() method from Symfony... but with your token.

Let me know if that helps!

Cheers!

Hey @Chtioui!

Hmm very interesting! So, you're using LexikJWTAuthenticationBundle with "stateless" authentication is that correct? What I mean is: you send the JWT with every API request, right? You do not rely on just "logging in once" and then using the session to authenticate you on future request. Let me know if that assumption is incorrect :).

Anyways, if you ARE using "stateless" authentication, then I have no idea what's happening yet :P.

But if you ARE relying on session authentication, then I still don't totally know what's happening, but I can offer some info. On each request, Symfony attempts to load the User object from the session. It then checks to see if some of the important fields on that User object (the one that was stored in the session) have since changed in the database - for example, if the password has been changed. If any of these fields have changed, it does NOT load your User (i.e. it effectively logs you out). This is a security mechanism so that if you change your password on one computer because someone hacked your account, it will log ALL devices out of your account immediately. The logic for this is here: https://github.com/symfony/symfony/blob/0eb03203c800b11bac4496a3e84c75e2966d5507/src/Symfony/Component/Security/Http/Firewall/ContextListener.php#L281-L321

However, normally, if you change your password on a request, then at the end of that request, when Symfony serializes the User into the session, it will serialize the User object that contains the NEW hashed password. And so, in the next request, everything will work fine.

So, something feels weird to me. Can you tell me a bit more about your situation - are you using stateless auth or session-based auth? When exactly do you get the "Invalid credentials" error - is that on the NEXT request? Are you sending a JWT on that? What does your JWT contain?

Cheers!

Hello @weaverryan,

-Yes i'm using stateless authentication with the LexikJWTAuthenticationBundle and i'm using the user's username and password for generating the JWT token.
-I get the "Invalid credentials" error on the next request and the user is no longer authenticated in my web app.

-I think whats happening is normal because the user is updating his login credentials (username & password in my case) that's why i'm getting the error "Invalid credentials" with the status 401 also I get this error only when update the user's login credentials but if I update other properties of the user's class everything works fine and I got no errors from the api response.

-I want to know if there is any mechanism to integrate to solve the problem or do I need to authenticate again the user after he updates one of his login credentials.

*firewalls in security.yaml:

security firewall

    firewalls:
        api:
            pattern: ^/api/
            stateless: true
            provider: app_user_provider
            jwt: ~
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            json_login:
                check_path: /authentication_token
                username_path: username
                password_path: password
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
            refresh_jwt:
                check_path: /authentication_token/refresh # or, you may use the `api_refresh_token` route name
            logout:
                path: app_logout

Lexik bundle file configuration:

Lexic bundle configuration file

lexik_jwt_authentication:
    secret_key: '%env(resolve:JWT_SECRET_KEY)%'
    public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
    pass_phrase: '%env(JWT_PASSPHRASE)%'
    token_ttl: 1800 # 30min in seconds 1800

Cheers!

Hey @Chtioui!

Hmm. If the user changes their username, it DOES make sense that you would lose authentication since the username is what's added to the JWT... and then that username is read from the JWT to find the user. So if you change the username, that user won't be found. To fix that, you could change your JWT to use the id instead, which is probably safer anyways. I'm not sure exactly how you're supposed to do this - but the https://symfony.com/bundles/LexikJWTAuthenticationBundle/current/2-data-customization.html seems to be close.

I don't understand why changing the password is also causing problems - but you did mention that:

Yes i'm using stateless authentication with the LexikJWTAuthenticationBundle and i'm using the user's username and password for generating the JWT token

So perhaps you're adding and using the password in the token in some manual way already.

Anyways, to fix the issue, you'll need to either:

A) Re-authenticate after this (as you know is already possible)
or
B) Somehow send back a fresh JWT from the user endpoint where you update the email/password. I'm not sure how standard this is... but in theory, you could register an event listener that could add a custom response header - e.g. X-JWT to this endpoint. It's a non-trivial problem. You might, inside User::setPlainPassword() and setUsername() set some flag on your User like $this->needsNewJWT = true. Then register a ResponseListener and look for that (you can get the User object via $request->attributes->get('data').

I hope this gives you some hints :)

Cheers!