[Slim] Add Basic authentication middleware #606

ybelenko · 2018-07-20T00:58:08Z

PR checklist

Read the contribution guidelines.
Ran the shell script under ./bin/ to update Petstore sample so that CIs can verify the change. (For instance, only need to run ./bin/{LANG}-petstore.sh and ./bin/security/{LANG}-petstore.sh if updating the {LANG} (e.g. php, ruby, python, etc) code generator or {LANG} client's mustache templates). Windows batch files can be found in .\bin\windows\.
Filed the PR against the correct branch: master, 3.1.x, 4.0.x. Default: master.
Copied the technical committee to review the pull request if your PR is targeting a particular programming language.

Description of the PR

Basic auth middleware verifies token from Authorization header.
If token not verified it returns 401 http status code and quits script execution.
~~User needs to implement verifyCredentials method in AuthBasic.php. By default this method always returns false to avoid security holes on production.~~ My code swapped with tuupola/slim-basic-auth package.
For a quick start, user needs to implement own authenticator in SlimRouter class:

$basicAuth = new HttpBasicAuthentication([
    "secure" => false,
    "authenticator" => function ($arguments) {
        $user = $arguments["user"];
        $password = $arguments["password"];
        // write your own code here, compare credentials with database etc.
        return false;
    }
]);

Test endpoint with Basic auth:

$ curl -X POST "http://petstore.swagger.io:80/v2/fake" \
    -H "accept: application/json" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "number=33&double=68.9&pattern_without_delimiter=FooBar&byte=fdfdfdf" -i

Output:

HTTP/1.1 401 Unauthorized
Date: Tue, 24 Jul 2018 08:54:42 GMT
Server: Apache/2.4.23 (Win64) PHP/7.2.7
X-Powered-By: PHP/7.2.7
WWW-Authenticate: Basic realm="Protected"
Content-Length: 0

cc @jebentier @dkarlovi @mandrean @jfastnacht @ackintosh

ybelenko · 2018-07-20T02:43:37Z

At the last moment I've found slim-basic-auth package.
Obviously this package more stable than my script, but I've noticed few disadvantages:

Big dependency list
Hardcoded 401 response when credentials doesn't match
Too many settings
Plugin allows unsecure connection for only relaxed hosts
We need two more middlewares(ApiKey, OAuth) and I don't think that existen plugins will follow same code patterns as described one.

ybelenko · 2018-07-23T09:49:00Z

@wing328 @ackintosh One more thing. If we use 3rd party package then user have only settings without access to middleware source files. I'm still thinking what approach I should use.

wing328 · 2018-07-23T17:25:17Z

If we use 3rd party package then user have only settings without access to middleware source files

Normally users shouldn't need to modify the source code of slim-basic-auth (or other PHP libs). If slim-basic-auth fails to meet their requirement somehow, I would suggest opening an issue instead as slim-basic-auth is pretty active and likely the owners of slim-basic-auth can address that.

Here are my feedback (although I've not played with slim-basic-auth before):

Big dependency list (If we're doing it ourselves, we may end up having a big dependency list as we cater more and more use cases. Anyway, please open an issue ot see if the dependency list can be further trimmed down)
Hardcoded 401 response when credentials doesn't match (To me 401 seems a reasonable default but please share with slim-basic-auth team if there are other response code you want to use by providing the details of your use case)
Too many settings (depends on how we look at it - users may find these settings useful in their use/edge cases)
Plugin allows unsecure connection for only relaxed hosts (please open an issue to share your feedback)
We need two more middlewares(ApiKey, OAuth) and I don't think that existen plugins will follow same code patterns as described one (I'm ok with that as I've not seen any API that needs both HTTP basic auth and APIKey/OAuth at the same time)

User needs to add own implementation to verifyCredentials method in AuthBasic.php.

I'm not sure about `middlewareSrcPath` variable. I'll fix it in following PRs if path is broken. Hope that notice in README catches attention and most of users will read it.

This reverts commit 204ee02.

This reverts commit 6a8e030.

Package "tuupola/slim-basic-auth" 3.1.0 requires PHP 7, that's why I set it's version to ^3.0.0 in Composer. Minimum version will be 3.0.0-rc.1 which supports PHP 5.5. I've tested build with PHP 7, it would be nice to check build with PHP 5.5 someday.

Not sure about forward slash in path to SlimRouter class. I will fix it in upcoming PRs if necessary.

ybelenko · 2018-07-24T09:03:34Z

I can remove revert commits and wipe off custom implementation from history if needed.

wing328 · 2018-07-31T07:28:20Z

samples/server/petstore/php-slim/phpunit.xml.dist

-            <directory suffix=".php">./lib/Api</directory>
-            <directory suffix=".php">./lib/Model</directory>
+            <directory suffix=".php">./lib//Api</directory>
+            <directory suffix=".php">./lib//Model</directory>


@ybelenko I believe the double forward slash won't cause any issue. Please correct me if I'm wrong.

Hmmm, and what are benefits from double forward slash, may I ask? 😄

Well I do not know. I spotted the double forward slash and just asking to make sure phpunit still works fine with it.

Just checked on Win8.1, phpunit works fine. These slash changes is result of #610 . I just use {{apiSrcPath}} and {{modelSrcPath}} which defined in AbstractPhpCodegen.

jmini · 2018-08-01T12:31:48Z

This PR breaks the Shippable CI build => ensure-up-to-date

ybelenko · 2018-08-01T12:45:06Z

@jmini Sad to hear it. Any ideas what's wrong and how to fix it?

jmini · 2018-08-01T12:50:03Z

@ybelenko thank you for asking, no problem.

I have run bin/utils/ensure-up-to-date and pushed corresponding commit: d8ea28e

It is now OK on master.

* [Slim] Add Basic Authentication Middleware User needs to add own implementation to verifyCredentials method in AuthBasic.php. * [Slim] Update README template I'm not sure about `middlewareSrcPath` variable. I'll fix it in following PRs if path is broken. Hope that notice in README catches attention and most of users will read it. * Revert "[Slim] Update README template" This reverts commit 204ee02. * Revert "[Slim] Add Basic Authentication Middleware" This reverts commit 6a8e030. * [Slim] Add "tuupola/slim-basic-auth" package Package "tuupola/slim-basic-auth" 3.1.0 requires PHP 7, that's why I set it's version to ^3.0.0 in Composer. Minimum version will be 3.0.0-rc.1 which supports PHP 5.5. I've tested build with PHP 7, it would be nice to check build with PHP 5.5 someday. * [Slim] Update README template Not sure about forward slash in path to SlimRouter class. I will fix it in upcoming PRs if necessary. * [Slim] Refresh samples

ybelenko changed the title ~~[Slim] Add Basic authentication middleware~~ [WIP][Slim] Add Basic authentication middleware Jul 20, 2018

ackintosh added Enhancement: Feature Server: PHP WIP Work in Progress labels Jul 20, 2018

ybelenko added 7 commits July 24, 2018 11:08

[Slim] Add Basic Authentication Middleware

6a8e030

User needs to add own implementation to verifyCredentials method in AuthBasic.php.

[Slim] Update README template

204ee02

I'm not sure about `middlewareSrcPath` variable. I'll fix it in following PRs if path is broken. Hope that notice in README catches attention and most of users will read it.

Revert "[Slim] Update README template"

0e53319

This reverts commit 204ee02.

Revert "[Slim] Add Basic Authentication Middleware"

07838ec

This reverts commit 6a8e030.

[Slim] Update README template

cd5adb0

Not sure about forward slash in path to SlimRouter class. I will fix it in upcoming PRs if necessary.

[Slim] Refresh samples

af5f30b

ybelenko force-pushed the slim_basic_authentication branch from d0132c6 to af5f30b Compare July 24, 2018 08:57

ybelenko changed the title ~~[WIP][Slim] Add Basic authentication middleware~~ [Slim] Add Basic authentication middleware Jul 24, 2018

wing328 removed the WIP Work in Progress label Jul 27, 2018

wing328 reviewed Jul 31, 2018

View reviewed changes

wing328 merged commit 58e0946 into OpenAPITools:master Jul 31, 2018

wing328 added this to the 3.2.0 milestone Jul 31, 2018

ybelenko deleted the slim_basic_authentication branch July 31, 2018 16:56

ybelenko mentioned this pull request Aug 10, 2018

[Slim] General enhancement discussion #384

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Slim] Add Basic authentication middleware #606

[Slim] Add Basic authentication middleware #606

ybelenko commented Jul 20, 2018 •

edited

Loading

ybelenko commented Jul 20, 2018 •

edited

Loading

ybelenko commented Jul 23, 2018

wing328 commented Jul 23, 2018

ybelenko commented Jul 24, 2018

wing328 Jul 31, 2018

ybelenko Jul 31, 2018

wing328 Jul 31, 2018

ybelenko Jul 31, 2018

wing328 Jul 31, 2018

jmini commented Aug 1, 2018 •

edited

Loading

ybelenko commented Aug 1, 2018

jmini commented Aug 1, 2018

[Slim] Add Basic authentication middleware #606

[Slim] Add Basic authentication middleware #606

Conversation

ybelenko commented Jul 20, 2018 • edited Loading

PR checklist

Description of the PR

ybelenko commented Jul 20, 2018 • edited Loading

ybelenko commented Jul 23, 2018

wing328 commented Jul 23, 2018

ybelenko commented Jul 24, 2018

wing328 Jul 31, 2018

Choose a reason for hiding this comment

ybelenko Jul 31, 2018

Choose a reason for hiding this comment

wing328 Jul 31, 2018

Choose a reason for hiding this comment

ybelenko Jul 31, 2018

Choose a reason for hiding this comment

wing328 Jul 31, 2018

Choose a reason for hiding this comment

jmini commented Aug 1, 2018 • edited Loading

ybelenko commented Aug 1, 2018

jmini commented Aug 1, 2018

ybelenko commented Jul 20, 2018 •

edited

Loading

ybelenko commented Jul 20, 2018 •

edited

Loading

jmini commented Aug 1, 2018 •

edited

Loading