Front end API, token auth and session data

[Tony-S]

Hi, I have a working front end API that works with the user plugin and has both routes that don't require authentication and routes requiring authentication. This all currently works and uses cookies. Importantly I make a lot of use of session data. Getting it to work was partly luck as I tried different things as it's right on the edge of my knowledge area compared to the application side where I'm fine. An extract from the authenticated side of my routing is:
Route::namespace('Mynamespace\Api\Api\V1') ->prefix('api/v1') ->middleware(['Winter\User\Classes\AuthMiddleware', 'Illuminate\Session\Middleware\StartSession']) ->group( function () { Route::prefix('user')->group(function(){ Route::get('/account', 'User@index'); }); });
The API connects to a Vue Storefront front end (different developers). They want to use token auth rather than cookies and I'm trying to see if this is possible. Firstly can session data be used with token auth or, as I suspect, is session data something that just relates to cookies? If it is possible, would it require for example one of the OC JWT Auth plugins to achieve this and how would that tie in with sessions?
Thanks for any help and as I say, this side of things is on the outer limits of my knowledge, currently and trying to learn what I can about it.

[mjauvin]

As far as I know, a session is identified by a cookie even though by default the session data is not saved in cookies.

I think you'd have to develop your own session library if this is not what you need (or maybe a package already exists for this)

[mjauvin]

Maybe look at Laravel Sanctum?
https://laravel.com/docs/10.x/sanctum#introduction

[Tony-S]

Thanks for your answers. Sanctum certainly looks an interesting package but it still uses session cookies where session data is involved so might not give them what they want. I'll talk to the front end devs and see if this helps them at all. Thanks.

[mjauvin]

Maybe Laravel Passport?
https://laravel.com/docs/10.x/passport#introduction

[Tony-S]

I can see that that may well provide the session data requirement but is quite a heavy solution, I'll talk to the devs. Your input is appreciated! Thanks.

[bennothommo]

The standard sessions in the User plugin do use cookies for sessions, but you can leverage the once() / onceUsingId() methods in \Winter\User\Classes\AuthManager to do a "stateless" authentication of a user. When combined with bearer tokens, it could provide you authentication for an API.

The idea would be:

• Use a Redis database connection facade, or possibly the Cache facade.
• Set up an API endpoint in the routes to authenticate for an API token using the user credentials - ie. POST /authorize - and using \Winter\User\Classes\Auth::once(['username' => '', 'password' => '']) to see if the credentials match a user. If they do, create a token and save it in your Redis database or cache with the user ID (along with any other data that you might need for the session)
• Set up a middleware to read the token and, if it matches and is valid, use the onceUsingId method with the user ID stored with that token to authenticate them for the request to control access to the API endpoints.
• In your authenticated API endpoints, use the bearer token to find their entry in the Redis database or cache and retrieve the session data as required.

That's the basic gist of it. You would probably need to consider further controls like expiring the tokens, but that would at least provide you simple API authentication.

[Tony-S]

Thanks - I'll have a look.

[damsfx]

@Tony-S Maybe you can check the OCMS user plugin that had JWT support in version 2.1?
rainlab/user-plugin@v2.0.0...v2.1.0

Could this be a good basis.

[Tony-S]

Interesting, thanks, I'll have a look!

[josephcrowell]

There's also this JWT extension to the User plugin: https://github.com/rluders/wn-jwtauth-plugin