[Security] Add a JSON authentication listener #18952

dunglas · 2016-06-02T12:16:55Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	n/a
License	MIT
Doc PR	symfony/symfony-docs#7081

Add a new authentication listener allowing to login by sending a JSON document like:

{"_username": "dunglas", "_password": "foo"}.

It is similar to the traditional form login (but take a JSON document as entry) and is convenient for APIs, especially used in combination with JWT.

See api-platform/core#563 and lexik/LexikJWTAuthenticationBundle#123 (comment) for previous discussions.

Add functional tests in security bundle

chalasr · 2016-06-02T12:36:09Z

👍 A great help for JSON APis!

GromNaN · 2016-06-02T13:58:29Z

Unless you have to pass the JWT and the login/password in the same request, the standard way for password authentication is HTTP Basic. This is supported out of the box in Symfony and easy to do with jQuery.ajax.
Then a simple controller that return a new JWT can be created as an entry point.

chalasr · 2016-06-02T18:26:15Z

@GromNaN I agree about that HTTP Basic and form-data stay the standard way for getting a JWT (& simpler for most cases).
But that's not an absolute rule and, depending on the client's platform/language/framework or simply out of preference, JSON can be the way to go.
Also I think that this could be helpful for a large number of use cases therefore good to have in Symfony

teohhanhui · 2016-06-03T10:40:30Z

Does this make https://github.com/gfreeau/GfreeauGetJWTBundle obsolete?

dunglas · 2016-06-03T10:46:28Z

@teohhanhui AFAIK, GfreeauGetJWTBundle is for x-www-formencoded data, not for JSON documents.
@GromNaN it's more common to send JSON documents (or form data) than using HTTP Basic auth to get a JWT token. Most client-side and server-side libs work that way.

teohhanhui · 2016-06-03T10:50:50Z

@dunglas:

GfreeauGetJWTBundle is for x-www-formencoded data, not for JSON documents

But the usual intention is to avoid form_login, which uses cookies. The fact that it uses x-www-form-urlencoded seems to me simply due to ease of implementation (the code seems to be adapted from Symfony's UsernamePasswordFormAuthenticationListener).

jorge07 · 2016-06-03T10:53:00Z

Why not a Request body listener like FOSRestBundle has? But that way you can use also XML for example... I'm already using exactly this way to login with Json on 3.0.6 with FOSRestBundle 2

xabbuh · 2016-06-05T06:49:22Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+            throw new BadCredentialsException(sprintf('Missing key "%s".', $this->options['password_parameter']));
+        }
+
+        $username = $data[$this->options['username_parameter']];


What about using property paths here? One might not always have the required information on the top level, but may want to wrap it in some other structure.

dunglas · 2016-06-08T15:54:37Z

I've done some changes to this PR:

The provider is now stateless (it doesn't use the session)
It uses the PropertyAccess component to access the username and the password as brilliantly suggested by @xabbuh
Functional tests added

It is ready for review.

chalasr · 2016-07-01T21:38:46Z

.../Bundle/SecurityBundle/Tests/Functional/Bundle/JsonLoginBundle/Controller/TestController.php

+{
+    public function loginCheckAction()
+    {
+        throw new \RuntimeException('loginAction() should never be called.');


Should be loginCheckAction() should never be called..

could make use of __FUNCTION__ actually

Simperfit · 2016-07-02T18:58:45Z

LGTM

xabbuh · 2016-07-04T07:59:11Z

The min version in the composer.json file of the SecurityBundle needs to be updated.

@dunglas Can you rebase here to hopefully let Travis run the job on PHP 7 again.

dunglas · 2016-07-10T08:44:22Z

Rebased against master and comments fixed.

dunglas · 2016-07-17T10:25:50Z

ping @symfony/deciders (HHVM error not related)

xabbuh · 2016-07-18T07:07:43Z

Imo you should also add a functional test case covering a config where the username_path and password_path are actually used.

dunglas · 2016-08-16T11:49:03Z

@xabbuh test updated.

javiereguiluz · 2016-10-25T11:08:59Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+    public function handle(GetResponseEvent $event)
+    {
+        $request = $event->getRequest();
+        $data = json_decode($request->getContent());


Should we protect here ourselves by checking the max. length of the request content in the same way that we check the max username (Security::MAX_USERNAME_LENGTH) and password a bit later?

@javiereguiluz but what is the max length of the request? The login and password can be stored in any JSON document. It would be similar to checking the length of the form in the traditional login form and AFAIK we don't do it currently.

I'm not an expert about this topic. I just saw this json_decode() that accepts the raw user's input and I was thinking about sending a 100MB request to make the application explode ;)

I'm not a security expert either, but it's the same for all endpoints in this case :) There are some configurations in PHP to avoid such problems (like post_max_size, max_execution_time and memory_limit). The check on the username length isn't related to DDOS attacks.

dunglas · 2016-10-25T11:25:00Z

Docs added symfony/symfony-docs#7081

fabpot · 2016-10-30T16:28:23Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+        }
+
+        if (!is_string($username)) {
+            throw new BadCredentialsException(sprintf('The key "%s" must contain a string.', $this->options['username_path']));


The key "%s" must be a string.?

fabpot · 2016-10-30T16:28:36Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+        }
+
+        if (!is_string($password)) {
+            throw new BadCredentialsException(sprintf('The key "%s" must contain a string.', $this->options['password_path']));


The key "%s" must be a string.?

fabpot · 2016-10-30T16:28:59Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+        try {
+            $username = $this->propertyAccessor->getValue($data, $this->options['username_path']);
+        } catch (AccessException $e) {
+            throw new BadCredentialsException(sprintf('Missing key "%s".', $this->options['username_path']));


The "%s" key must be provided.?

fabpot · 2016-10-30T16:29:03Z

src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php

+        try {
+            $password = $this->propertyAccessor->getValue($data, $this->options['password_path']);
+        } catch (AccessException $e) {
+            throw new BadCredentialsException(sprintf('Missing key "%s".', $this->options['password_path']));


The "%s" key must be provided.?

fabpot · 2016-11-06T19:31:51Z

👍 for 3.3

…ner class

fabpot · 2016-12-03T11:14:02Z

Thank you @dunglas.

This PR was squashed before being merged into the 3.3-dev branch (closes #18952). Discussion ---------- [Security] Add a JSON authentication listener | Q | A | | --- | --- | | Branch? | master | | Bug fix? | no | | New feature? | yes | | BC breaks? | no | | Deprecations? | no | | Tests pass? | yes | | Fixed tickets | n/a | | License | MIT | | Doc PR | symfony/symfony-docs#7081 | Add a new authentication listener allowing to login by sending a JSON document like: `{"_username": "dunglas", "_password": "foo"}`. It is similar to the traditional form login (but take a JSON document as entry) and is convenient for APIs, especially used in combination with JWT. See api-platform/core#563 and lexik/LexikJWTAuthenticationBundle#123 (comment) for previous discussions. - [x] Add functional tests in security bundle Commits ------- 02178bc [Security] Add a JSON authentication listener

This PR was merged into the master branch. Discussion ---------- JSON authentication listener docs Docs for symfony/symfony#18952. Commits ------- b192ab3 Fixed a syntax issue 16ae3f6 Reworded and simplified the article 820f28e Fixed the name of the "username" property 6d018f6 Fixed a syntax error ab5259b Removed a tip which is not too relevant for the article d2dd895 Fixed the JSON format (this time for real) 6ff24da Fixed the JSON format 0961128 Show the simple example first and then explain the complex use case 68bd9a5 JSON authentication listener docs

dunglas added Security SecurityBundle labels Jun 2, 2016

carsonbot added Status: Needs Review Feature BC Break Deprecation labels Jun 2, 2016

dunglas removed BC Break Deprecation labels Jun 2, 2016

This was referenced Jun 2, 2016

Allow credentials to be sent as JSON lexik/LexikJWTAuthenticationBundle#123

Closed

LexikJWTAuthentication bridge api-platform/core#563

Closed

xabbuh reviewed Jun 5, 2016
View reviewed changes

chalasr reviewed Jul 1, 2016
View reviewed changes

dunglas force-pushed the json_authentication_listener branch from 8475884 to cd86c9e Compare July 10, 2016 08:33

dunglas force-pushed the json_authentication_listener branch from 163a36a to 653bebb Compare July 17, 2016 10:02

dunglas force-pushed the json_authentication_listener branch from 5c085a6 to ee40718 Compare October 25, 2016 11:05

javiereguiluz reviewed Oct 25, 2016

View reviewed changes

dunglas mentioned this pull request Oct 25, 2016

JSON authentication listener docs symfony/symfony-docs#7081

Merged

fabpot reviewed Oct 30, 2016

View reviewed changes

dunglas force-pushed the json_authentication_listener branch from ee40718 to 8fd5666 Compare November 2, 2016 14:54

javiereguiluz added this to the 3.3 milestone Nov 6, 2016

dunglas force-pushed the json_authentication_listener branch from 8fd5666 to e0bb4e4 Compare December 2, 2016 08:22

dunglas added 3 commits December 2, 2016 09:25

[Security] Add UsernamePasswordJsonAuthenticationListener class

4261e6a

[SecurityBundle] Register the UsernamePasswordJsonAuthenticationListe…

84114ad

…ner class

Update exception messages

10ecbe1

dunglas force-pushed the json_authentication_listener branch from e0bb4e4 to 10ecbe1 Compare December 2, 2016 08:27

Update composer.json

3477b2d

fabpot closed this Dec 3, 2016

dunglas deleted the json_authentication_listener branch December 3, 2016 14:23

swquinn mentioned this pull request Jan 2, 2017

Difference in resulting token between UsernamePasswordJsonAuthenticationListener and UsernamePasswordFormAuthenticationListener #21123

Closed

teohhanhui mentioned this pull request Mar 1, 2017

Removed post_only option. Add JSON as valid request format gfreeau/GfreeauGetJWTBundle#24

Merged

dmaicher mentioned this pull request Mar 17, 2017

Json authentication listener tries to authenticate on all routes #21948

Closed

nicolas-grekas modified the milestones: 3.x, 3.3 Mar 24, 2017

lsmith77 mentioned this pull request Apr 13, 2017

[Security] json_login tries to handle every request #22423

Closed

dmaicher mentioned this pull request Apr 13, 2017

[Security] Allow to set a check_path on json_login listener #22425

Closed

fabpot mentioned this pull request May 1, 2017

Release v3.3.0-BETA1 #22603

Merged

HeahDude mentioned this pull request Jul 2, 2018

json-login-ldap symfony/symfony-docs#9987

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Add a JSON authentication listener #18952

[Security] Add a JSON authentication listener #18952

dunglas commented Jun 2, 2016 •

edited

Loading

chalasr commented Jun 2, 2016

GromNaN commented Jun 2, 2016 •

edited

Loading

chalasr commented Jun 2, 2016 •

edited

Loading

teohhanhui commented Jun 3, 2016

dunglas commented Jun 3, 2016 •

edited

Loading

teohhanhui commented Jun 3, 2016 •

edited

Loading

jorge07 commented Jun 3, 2016

xabbuh Jun 5, 2016

dunglas commented Jun 8, 2016 •

edited

Loading

chalasr Jul 1, 2016

theofidry Jul 2, 2016

Simperfit commented Jul 2, 2016

xabbuh commented Jul 4, 2016

dunglas commented Jul 10, 2016

dunglas commented Jul 17, 2016

xabbuh commented Jul 18, 2016 •

edited

Loading

dunglas commented Aug 16, 2016

javiereguiluz Oct 25, 2016

dunglas Oct 25, 2016 •

edited

Loading

javiereguiluz Oct 25, 2016 •

edited

Loading

dunglas Oct 25, 2016

dunglas Oct 25, 2016

dunglas commented Oct 25, 2016

fabpot Oct 30, 2016

fabpot Oct 30, 2016

fabpot Oct 30, 2016

fabpot Oct 30, 2016

fabpot commented Nov 6, 2016

fabpot commented Dec 3, 2016

[Security] Add a JSON authentication listener #18952

[Security] Add a JSON authentication listener #18952

Conversation

dunglas commented Jun 2, 2016 • edited Loading

chalasr commented Jun 2, 2016

GromNaN commented Jun 2, 2016 • edited Loading

chalasr commented Jun 2, 2016 • edited Loading

teohhanhui commented Jun 3, 2016

dunglas commented Jun 3, 2016 • edited Loading

teohhanhui commented Jun 3, 2016 • edited Loading

jorge07 commented Jun 3, 2016

Choose a reason for hiding this comment

dunglas commented Jun 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Simperfit commented Jul 2, 2016

xabbuh commented Jul 4, 2016

dunglas commented Jul 10, 2016

dunglas commented Jul 17, 2016

xabbuh commented Jul 18, 2016 • edited Loading

dunglas commented Aug 16, 2016

Choose a reason for hiding this comment

dunglas Oct 25, 2016 • edited Loading

Choose a reason for hiding this comment

javiereguiluz Oct 25, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dunglas commented Oct 25, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabpot commented Nov 6, 2016

fabpot commented Dec 3, 2016

dunglas commented Jun 2, 2016 •

edited

Loading

GromNaN commented Jun 2, 2016 •

edited

Loading

chalasr commented Jun 2, 2016 •

edited

Loading

dunglas commented Jun 3, 2016 •

edited

Loading

teohhanhui commented Jun 3, 2016 •

edited

Loading

dunglas commented Jun 8, 2016 •

edited

Loading

xabbuh commented Jul 18, 2016 •

edited

Loading

dunglas Oct 25, 2016 •

edited

Loading

javiereguiluz Oct 25, 2016 •

edited

Loading