I have an app that uses ember-simple-auth for Google authentication. All requests to my PHP backend are authorized with a Google access token, which the backend checks with Google before doing anything else. I understand ember-simple-auth has a testing package, but how would I go about testing this app?
The backend is a part of the app's repository, under app/api/.
An approach would be to customise the PHP code depending on the environment (importing config/environment.js), but it's on the backend and it's written in PHP.
You don't want your ember cli tests to depend on the backend so you can simply use ember-simple-auth-testing which will give you a readily authenticated session without interacting with the server at all.
Related
I have a nextjs app that I'm using to process stripe payments that I've deployed to Vercel. The app is simply a form with tons of functionality built in but requires the use of an api (which is why I'm using nextjs). What is the best way to get this into a php site? I need to access the nextjs api in order to communicate with stripe. Otherwise I would have just built the react app in the php site and rendered it on the page in question per usual. I've never done this before, so please any recommendations would be huge.
Here are the options I've come up with:
iframe. I've never been a huge fan of these, but figured this was an option. I can render my app via iframe on the php site.
use the vercel deployed nextjs app strictly for the api and build the react form into the php site. Then I would simply change the api requests to point to the vercel deployed nextjs app instead of a local api.
Are there better more efficient methods?
Try vercel-php, a PHP runtime for Vercel. Using the configuration described in the README, you can use a PHP repository as your backend and fetch data from there for your NextJS app.
Alternatively, you can use this directly in your NextJS repository and instead of having the api folder inside the pages directory, just have it as a top-level directory
I am having a PHP based application, that uses MySQL as the DB. I am currently trying to build a real-time messaging system for the users in the application. I have found Firebase to be a very good solution for building this. However, I am not sure if the architecture I am planning is compatible with the architecture am planning. Digging through the documentation didn't really get me the answers.
My Doubts are:
I don't want users to again login to use chat, so I want to
authenticated via the server (i.e from php).
I want, the further chat/messaging to happen from client to Firebase directly as I don't want to have unwanted overhead on my server, especially when a direct connection is not only supported but also efficient.
Can I authenticate via php and get some secret key or something and then use that to connect securely via Js?
I found this link which talks about custom authentication system. But am not sure, if this is what I have to use. And if the solution am planning is scalable and ok.
Firebase Auth persists the session on the client via localStorage/indexedDB and is a headless API that doesn't require a hosted server. So you are not required to authenticate the user via your server.
You can definitely build the messaging app entirely on the client with real-time database without routing traffic to your server. Here is an example of a chat app built with Firebase: https://github.com/firebase/friendlychat
If you already have an existing authentication system, you can use custom auth which requires that you mint a custom token after you authenticate a user with your system, you then send that custom token to the client and then signInWithCustomToken. Here is some code to create a custom token with PHP: https://firebase.google.com/docs/auth/admin/create-custom-tokens#create_custom_tokens_using_the_firebase_admin_sdk
If you don't have an existing auth system, you can entirely run the authentication on the client side. Another good library for authentication that is built on top of Firebase is FirebaseUI: https://github.com/firebase/firebaseui-web
I'm building a REST API using Symfony2 (FOSRestBundle and FOSOAuthServerBundle) and I'm unsure on which grant type to use for this service.
I will have other developers register as users. I was looking at GitHub, and for each user they have a section called 'applications' in their settings which allows adding an application and it gives back client_id and client_secret. But AFAIK GitHub uses the authorization grant type which means you're sent to GitHub to accept and then redirected back to your application with the auth code (does the auth code live forever or what?). I'm not sure if this is what I'm looking for.
What I want is a way to allow developers to consume my API with me knowing who is accessing (FOSUserBundle integrates pretty well here) and what they are allowed to do.
Also, I'll have my own browser based application, Angular.js probably which is the main website where developers can register. It will make API calls to present data for whichever dev logs in. I could use a Node.js backend (need it for some other stuff) so the actual calls are made from there instead as it seems browser only applications aren't really safe. I was thinking of using client credentials grant type from the Node.js backend.
And last, I'll have my own mobile app interacting with the API. Since it's a trusted service it should use Resource owner credentials grant, right?
I'm not sure I understand what you ask for here. As I understand it your developpers will have an account on which they will have to log in in order to use your API. In this case Client Credentials does not seem appropriate, since it would not identify a developper but a client. A client does not represent a user, it represents "an application that accesses your API" (it, in your case you would have one client for your mobile App and one client for your Angular website). I would use a password grant type, that does not redirect you to an external service.
When I had to implement a OAuth2 authentication for my API, I found this article very helpful, it is based on a Symfony2 example but most of the explanations apply everywhere.
I have a web application built in PHP, running behind Apache. The application uses its own security logic and sets $_SESSION['username'] to a valid username if a user logs into its web interface
The original developer has moved on, and I am adding APIs to this app so that people can develop 3rd party apps that connect. The API layer uses FriendsOfCake CRUD https://github.com/friendsofcake/crud
The API are working great, and now I want to add authentication. I know REST APIs should be stateless etc. However in this application, the people who can use the APIs MUST also be able to log into the web console.
Given that the core PHP app is already handling authentication and sets $_SESSION, I want my CRUD APIs to check if $_SESSION['user'] user is set.
The logic will be as follows:
a) Do a http://server/login.php POST with credentials (not via API layer)
b) Then do http://server/api/
If a) is not done, b) won't work. That is my goal.
How do I get access to $_SESSION ? When I try and access it in the API controller for one of the APIs, it is not defined. It is however available to the PHP apps that the current app uses.
Note that the APIs and the backend app are running on the same server like so:
web/ --> server php code
web/api --> API code (via FoC CRUD)
I have WPF app and Web browser control in it. I am opening a web page which is a php application.
I need to pass my machine credential's to the php application.
The Web browser control opens a [http://app/login.php]. The user has logged onto the machine with his domain credential's. The PHP website uses windows authentication..
Both the WPF application and php site are internal application(i.e. same domain)
You have a CakePHP application and a login.php? Then there is something seriously wrong with it.
You need to get your current logged in users identity and pass that on to the php application.
See Using windows authentication with php?
If you're using CakePHP 2.0 you might find an LDAP adapter for the AuthComponent. I guess you can use google to find more, I don't know if this one here is any good or not http://www.analogrithems.com/rant/2012/01/03/cakephp-2-0-ldapauth/
My answer covers the CakePHP part
Best practice would be to communicate using REST, between your wpf and cakephp. CakePHP provides a very easy way to connect your actions via REST. You will have to connect your authentication method using the REST.
Cake's documentation has a nice section on REST from CakePHP.