I explain my question using the following image.
1. First user login to my app which hosted on server [3], via cloud[1].
In the meantime, the user authenticates using Identity Provider[1].
And Identity Provider sends JWT to Cloud Server[1].
Then Cloud Sercer[1] send the request to my Application Server[1]
along with that JWT as request header and Application Server[3] then serve index page
back to the user.
Now my problem is I need to get that JWT within my ReactJs application in order to get user details within that JWT. Since React is client-side framework I unable to handle requests with React.
So my problem is how can I get this JWT from ReactJs side?
Yes, ReactJS it self cannot handle this because it's frontend.
You need to have a separate backend for your application (i.e BFF - backend for frontend). You can use a nodejs server to wrap your frontend and have a middleware to capture the JWT request and extract user details. Then at the time of serving to react frontend from the nodejs server, you can bind the information to it.
When binding I would prefer binding data to a javascript variable or function.
in your react index page you can have a global function.
<body>
<script type="application/javascript">
function getUserDetails(){
return JSON.parse("!!!!USER_DATA!!!!");
}
</script>
<div id="app"></div>
</body>
and you can replace '!!!!USER_DATA!!!!' part with a valid json with user details when rendering the react page from BFF. like this,
let userDetailJsonString = JSON.stringify(dataFromJWT);
res.send(renderingIndexPage.replace(/\!\!\!\!USER_DATA\!\!\!\!/g, userDetailJsonString.replace(/"/g, "\\\"")));
You can do this in different ways, You may try a different way.
Related
I am Practicing on a Project and using Rails as a api backend and React as Front end framework. I have implemented Authentication in React but now how I am got stuck at the question of how to implement authorization.
We know in Rails we use cancancan or other gem for authorization which is session based but I cant use cancancan now because My whole front-end is in rails. Are there any ways of doing this work?
If all the permissions are at the backend part, some of requests must return 401 and your frontend part must respond accordingly (render a popup e.g, show a message).
If you are trying to hide some unavailable parts (menu items, buttons, pages) beforehand, your frontend part must get a list of user roles / permissions from the back beforehand and render page using this infromation. You can provide this along with authentication request or as a separate request.
I, personally, prefer pundit over cancancan
I'm a newbie with authentication! I'm building a web app where users can log in, and the data shown in the web app is different for each user. I'm using Reactjs as my frontend with Firebase authentication. After a user logs into my web app, I'm storing their user ID (UID) and other information into Firestore. I have a collection usersCollection where each document is labelled with the UID. For the backend, I'm using Flask as mostly a REST API with a Postgres database, but I am not storing user credentials there (UID, password, etc.).
For some of my backend functions I need to change the output based on which user is signed in, but I'm not sure how to retrieve the current user's UID. I'm able to make an axios request to send the current user's UID from the frontend to the backend, so I've tried 2 methods with that:
Saving the axios request output as a global variable - this has led to Flask errors like runtimeerror: working outside of application context. and I don't think this is the best solution.
With each GET request that the frontend is making to the backend (every time there's a function whose output changes based on user), I am passing the UID as a parameter, which causes latency problems.
What is the simplest way for me to request the current UID from Firestore from the backend?
Is structuring our frontend, backend, database, and authentication like this recommended? Or is there a simpler way or better system for our situation (JWT?)? We selected Firebase authentication in the first place because we are using a React MUI template that already set up Firebase for us.
Thank you in advance! Happy to provide more information if needed!
I don't know reactjs, but I have the same setup with flutter (iOS / Android apps).
What I did and what worked out well is:
authenticate your client against firebase (which it looks you already achieved)
extract the idToken from the firebase response
send the idToken to your flask backend, which verifies the id token (see below)
in flask backend, log in the user with login_user() from flask_login. This creates a cookie session which is sent back to the client in the response headers
the reactjs client stores the cookie and needs to attach it to every subsequent API request to flask (this might come out of the box for reactjs, but for flutter I needed some custom code for that)
As for the token validation you can…
use the python sdk
use a jwt library such as pyjwt, see documentation
There is flask-firebase which does a good job for the token validation. I wrote a blog post which gives an example how you would use this.
I'm using Laravel 5 with AngularJS for a project, in a way so that Laravel is used as an API and the API routes are in Laravel, while the client side routes are in AngularJS (app.js).
Is it possible to use Laravel Middleware to protect AngularJS routes, so for example, I want it to use the RedirectIfAuthenticated Middleware on the angular login form page route so people can't go to that page if they are logged in, except normally as far as I know, the middleware is specified in the Laravel controller, which doesn't have logic for angular side routes - hence, the problem.
So the question is, can I use Middleware or do I have to make angular send a get request asking laravel if the user is logged in on every page? Wouldn't that be less secure?
What I ended up doing was making a client-side cookie on login in angular to keep track of whether the user is logged in or not for user experience purposes (hiding information, redirecting before the view is rendered), and using Laravel Middleware to protect API calls to make sure the user can't interact or get information from the API on the server and to keep it secure in case the user changes their cookie to lie about their login status.
Alternatively, you could also send a request to the server before each page loads instead of the cookie check, but that adds quite a bit more overhead, and isn't any more secure - as far as I know, since that API call to check if the user is logged in is just for UX purposes too and the javascript for that can be removed by a malicious user.
I have a problem with communication between angular and laravel.
Its about mobile application that needs to log in to a laravel framework and get some data.
Mobile application is angularjs based, and for login i user standard $httpd function.
Login works fine, and i get expected response from laravel, but when i make another request assuming that im loged in, laravel returns NULL for session and auth. When I upload mobile app to a server where laravel is installed all works like a charm. But my app needs to be on mobile device, so thats not a solution.
I assume that the problem is in cors or cross domain communication. It seems that laravel destroys session made from cross origin requests, because that session is not accessible from another request, and on another request laravel tries to make a new one.
I need help solving that session problem (access session after login or keep session), i hope some of you have some kind of a solution.
i tried :
changing headers in my login controller
changing get to post
adding content type to my angular http req (Content-Type': 'application/x-www-form-urlencoded)
tried requerst with jquery ajax
changed laravels app/config/session.php values of driver, cookie, domain...
setting vendor/laravel/framework/src/illuminate/http/frameGuard.php x-frame options to false
no luck!
Use json web tokens, and simply set it up so that you request a JWT on login, and you can share that token around - the only way it invalidates, is either if you lose the token, or it times out.
I want to conver my existing site to angularJS application. Its flow is like this.
My parent web site is having link to sign up or login page.
As per user selection signup or login page should open.So once user login or created account he pointed to dashboard page.So how to do this angularJS?
Please note my parent web site is not in angular.
Thanks in advnce.
Here is a suggested design and here is a little project I wrote that has Angular code authenticating with a PHP server. The code has both the Register and Log in options you are looking for.
Use token based authentication (Im assuming your angular requests are JSON)
After the user logs in or registers, send a bearer token back to Angular via the URL. On the server side set an expiry date for the token
Every http request you make can include the token in the http header
The sample code has this implemented.