I make an app with Cakephp but when i try to login from IE 8 or Safari it won't work (I can login from chrome and firefox).
I just use the login method of Auth component in my UsersController, I check in both beforeFilter (AppController and UsersController) and I pass trough them with a good Auth->user() and Users/index in my params[controller/action] (where I have to be redirect when login success) but just after I'm redirect to the login page with an empty Auth->user(), I don't understand why.
Sorry for my english and thanks you for your help.
I found the reason, but I don't know why and what to do... I actually have a domain name "www.domain.com" wich redirect to the IP of a remote server where is located the app. If I log from the domain the session is destroy at each page but if I log from the IP of the server where is the app it works.
Related
I have an app in React. This app has a link that allows the user to sign in to ORCID with his username and password (link opens in a new tab) and then the server returns a secret code to acces the API thorough the uri redirect link (as you can see in the link below), but if you check out the link, the redirect uri can not be http://localhost because it has to be https, so, how can I redirect the user back to my app instead to https://developers.google.com/oauthplayground?
LINK: https://orcid.org/oauth/authorize?client_id=APP-HNE1HE7JLDQNNJ1U&response_type=code&scope=/authenticate&redirect_uri=https://developers.google.com/oauthplayground
I have tried with fetch, but didn't work... should I close the window manually? copy paste the code to my app? pretty bad for the user actually...
Using aspnetcore 2.1and Identity Server 4 quickstart, I have setup a token server with an mvc client so that when the AuthorizeAttribute is used it redirects to the ID4 server login screen and after logging in it redirects back to the mvc client.
Since we were refactoring an old application with custom salt and hash in the database I have created a custom user store, role store and password hasher.
I can login fine using
signInManager.PasswordSignInAsync()
but it does not redirect back to the client as I would expect.
From the fiddler log i can see it redirects to /connect/authorize/callback then back to the login page.At which point the user is clearly logged in because the user name appears with the option to logout.I put in a breakpoint on the login get action and see that User.Identity.IsAuthenticated is true.
For testing I swapped the login method for the login action method from the is4inmem template which uses
HttpContext.SignInAsync(user.SubjectId, user.Username, props)
at which point it does redirect back to the client.
Am I missing some part of the custom userstore which _signInManager.PasswordSignInAsync calls to log users in the same way as HttpContext.SignInAsync?
Getting the config ready to paste here I relised that I had this line commented out:
builder.AddAspNetIdentity();
When I uncommented that it worked perfectly.
I am using laravel and AngularJS for development.
I have different portals and login page but login function is same to login all users at back end.
I want to check source URL before hitting to login function if URL is hitting from right portal to right user then it should proceed to application further other wise not.
If you wanna check the url then you can use $location provided by angular to see the url before sending the request.
When I test the setup on my laptop Chrome browser everything works just fine using both sameWindow and newWindow: I am able to login though for example Facebook and the user is authorized and can use my app.
However, when I try to deploy the app to android and use the inAppBrowser things break. When selecting the 'login through FB' button in my app I can see the inAppBrowser frame come up with the Facebook mobile site asking to login. When I inspect that specific window through Chrome inspect, I can see that the callback from FB coming in to omniauth on my server including state and code in the querystring:
https://<app>.herokuapp.com/omniauth/facebook/callback?code=<code>&state=<state>
This request receives a 302 redirect to the following URL:
https://<app>.herokuapp.com/api/v1/auth/facebook/callback
This follow-up request receives a 200 response. So far it all seems fine and the inAppBrowser window closes, we get back to my mobile app and I see the ng-token-auth "auth:login-success" event passing by.
However, any subsequent API requests to my server receive a 401 Not Authorized response. When I look at the request headers of those API requests I don't see any of the headers that Chrome on my laptop is sending to the server such as: access-token, client, expiry, token-type and uid.
I would be very grateful for any advice on where to look or what I am missing here.
Thanks!
Turns out that when working with ionic and I assume it is the same with cordova, storing the tokens according to default behavior in the cookie does not work. However, once you configure it to work with localStorage it works great!
For more info see this issue I opened at the GitHub project.
I have the following problem.
A reverse proxy is used to establish a secure (https) connection to a server in an internal network. So the address is https://<url>. If I am now on my login page (https://<url>/users/login) and hit "submit" the https is removed (by the loginRedirect) and it's trying to connect to the url via http. Of course that is running into an timeout but the users is logged in. If the user is then accessing a page directly it's working.
Once the users is on the page he can do everything that is necessary and the other links are showing up with https as expected.
How can I avoid that the loginRedirect is removing the https? One solution is to use simply $this->redirect('<url>'); instead of $this->redirect($this->Auth->redirect()); but then I would lose the handling of direct links if somebody is not logged in and tries to access a specific part of the page that requires authentication.
I just got help in the CakePHP lighthouse forum and I would like to share the solution with you. It was actually pretty easy. In a reverse proxy scenario you have to edit the bootstrap.php (in the config folder) and add the following base URL:
define('FULL_BASE_URL','https://your base url');