PHP, JWT passthrough path and method - php

Question

I'm building an application via slim framework and it's slim-jwt-auth middleware.
I installed it, and it works fine but I'm a bit confused with the passthrough possibility.
My RequestPathRule:
new \Slim\Middleware\JwtAuthentication\RequestPathRule([
"path" => ["/api"],
"passthrough" => ["/api/auth", "/api/users", "/api/products", "/api/orders", "/api/streets",
"/api/reservations", "/api/feedbacks", "api/menu"]
])
And my RequestMethodRule:
new \Slim\Middleware\JwtAuthentication\RequestMethodRule([
"passthrough" => ["POST", "GET"]
])
But it allows these methods to all endpoints. Actually, I want to let POST only to /api/auth, /api/orders, /api/reservations and /api/feedbacks, and GET for every endpoint except /api/users.
How is this possible?
Thank you in advance.

Answer 1

It would be interesting to see which are your routes, but basically in your current configuration your are saying:
1) DON'T Authenticate "/api/auth", "/api/users", "/api/products", "/api/orders", "/api/streets", "/api/reservations", "/api/feedbacks" and "api/menu" (rest of endpoints under /api MUST be authenticated)
2) AND also dont authenticate whatever POST or GET request
some examples:
PUT /api/users NEVER will be authenticate since /api/users is in
RequestPathRule
GET /api/users NEVER will be authenticate since /api/users is in
RequestPathRule AND GET is in RequestMehtodRule
PUT /api/whatever ALWAYS will be authenticate since /api/users is
NOT in RequestPathRule AND GET is NOT in RequestMethodRule
Basically rules work like an OR comparison operator and in the right moment an endpoint is in RequestPathRule OR a request method is in RequestMethodRule the request will be not authenticated.
A better approach could be trying not to use RequestMethodRule as much as possible (generally you just include OPTIONS method) and play with different paths.
In a normal web application you will provide a public API path to your clients under /api and the only endpoint you don't generally authenticate is /api/login (or /api/auth in your example) the rest of the endpoint under /api are authenticated. If your provide another set of endpoints which you don't want to authenticate you provide another different path like /service and your don't include it as "path" in RequestPathRule. If you need a set of endpoint ALL authenticated you create all of then under a new path, let's say /admin and you include on path in RequestPathRule and you don't add any "passthrough" for them.
So the idea is play with different path and just add those methods under RequestMethodRule for specific use cases. Moreover, in that way you will have a better clear and organized API.
Looking at your endpoints I recommend you create different path for most of them, so instead of having "/api/auth", "/api/users", "/api/products", "/api/orders" I would suggest you to have "/auth", "/user", "/product", "/order"... and you can add a RequestPathRule and RequestMethodRule for every path.
To be honest, as the slim-jwt-auth middleware is thought, it's difficult to provide CRUD operations over same endpoint, let's say you have GET, POST, PUT and DELETE over /user and you want just authenticate POST, PUT and DELETE. For that case you could have 2 options:
create differen endpoint for each verb like: GET /user/all, POST /user/add, PUT /user/edit and DELETE /user/delete (which is a bad practice
Create or extend your RequestPathRule and RequestMethodRule callable with the only conditions that they must implement RuleInterface and adapt them to your needs (highly recommended)
If you choose the 2nd option you only have to add those callable to the rules option. Something like this:
$app->add(new \Slim\Middleware\JwtAuthentication([
"rules" => [
new \My\Auth\Rules\RequestPathRule([
"path" => "/",
"passthrough" => []
]),
new \My\Auth\Rules\RequestMethodRule([
"passthrough" => ["OPTIONS"]
])
]
]));