Regaez/grav-plugin-api

docs: explain authentication

Regaez opened this issue · 6 comments

Regaez commented

We should create a docs/AUTHENTICATION.md file which explains the following:

  • explain authorisation using Grav Sessions
  • how to authenticate API requests using Basic auth
  • roles and their related permissions
  • how to define API roles on user accounts
  • how to create groups, and inherit group permissions as a user
  • explain taxonomy-based permissions
  • make a note about PHP-CGI and .htaccess workaround
masetto commented

Please, can you help me to use API request?
I tried with ajax:

$.ajax({
    url: '/api/pages/my-page',
    beforeSend: function(xhr) {
        xhr.setRequestHeader('Authorization', 'Basic ' + btoa(USERNAME + ':' + PASSWORD));
    }
});

The payload response was:

{"message":"Bad credentials","documentation":"https:\/\/github.com\/regaez\/grav-plugin-api\/tree\/master\/docs"}

I used an account with this permission:

access:
  api:
    super: 'true'

The $request->getHeader('PHP_AUTH_USER') is empty.
I'm sorry to write here, but I don't know who to ask.
Thanks

Regaez commented

@masetto Hmm. Based on your example code, that appears like it should work... Are you using PHP-CGI on your server?

masetto commented

@Regaez I use PHP FastCGI.
Now I added these lines to my .htaccess:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

and it works!
I didn't know about this problem.

  • 👍1
Regaez commented

Great! Thanks for commenting, I'll make sure to add this to the documentation when I get around to it.

Make sure you are also using HTTPS so you don't leak your credentials.

  • 👍1
masetto commented

@Regaez If I want to use the API "internally" (from the same site where API are installed), from a user logged in session, but I don't know his password, can I do it?

Regaez commented

This is currently not possible, as the authentication middleware only checks for Basic auth. However, it should be totally feasible, providing your site has a login plugin installed which adds the user to the session.

I hadn't considered this use case at all, but this would be a great feature to have in the API. I have created a new issue for this and will prioritise it for development. Please track the following issue: #78

  • 👍1