{"id":19571752,"url":"https://github.com/loadsys/cakephp-stateless-auth","last_synced_at":"2025-04-27T03:32:36.329Z","repository":{"id":28814456,"uuid":"32337655","full_name":"loadsys/CakePHP-Stateless-Auth","owner":"loadsys","description":"A replacement CakePHP Authentication/Authorization Component that is fully and strictly stateless. Designed to be used with Cake apps that are only accessed RESTfully.","archived":false,"fork":false,"pushed_at":"2015-07-10T14:44:47.000Z","size":485,"stargazers_count":7,"open_issues_count":3,"forks_count":4,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-04T20:51:25.090Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/loadsys.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-03-16T16:20:39.000Z","updated_at":"2018-12-19T07:48:20.000Z","dependencies_parsed_at":"2022-09-05T02:21:52.213Z","dependency_job_id":null,"html_url":"https://github.com/loadsys/CakePHP-Stateless-Auth","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/loadsys%2FCakePHP-Stateless-Auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/loadsys%2FCakePHP-Stateless-Auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/loadsys%2FCakePHP-Stateless-Auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/loadsys%2FCakePHP-Stateless-Auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/loadsys","download_url":"https://codeload.github.com/loadsys/CakePHP-Stateless-Auth/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251085145,"owners_count":21533821,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T06:19:56.043Z","updated_at":"2025-04-27T03:32:34.851Z","avatar_url":"https://github.com/loadsys.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CakePHP Stateless AuthComponent\n\n[![Latest Version](https://img.shields.io/github/release/loadsys/CakePHP-Stateless-Auth.svg?style=flat-square)](https://github.com/loadsys/CakePHP-Stateless-Auth/releases)\n[![Software License](https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square)](LICENSE.md)\n[![Build Status](https://travis-ci.org/loadsys/CakePHP-Stateless-Auth.svg?branch=master\u0026style=flat-square)](https://travis-ci.org/loadsys/CakePHP-Stateless-Auth)\n[![Coverage Status](https://coveralls.io/repos/loadsys/CakePHP-Stateless-Auth/badge.svg)](https://coveralls.io/r/loadsys/CakePHP-Stateless-Auth)\n[![Total Downloads](https://img.shields.io/packagist/dt/loadsys/cakephp-stateless-auth.svg?style=flat-square)](https://packagist.org/packages/loadsys/cakephp-stateless-auth)\n\nA replacement CakePHP Authentication/Authorization Component that is fully and strictly stateless. Designed to be used with Cake apps that are only accessed RESTfully.\n\nThe provided component is intended to replace Cake's stock `AuthCompnent`. This replacement `StatelessAuthComponent` is a stripped down and simplified version that by default looks for an `Authorization` header in the HTTP request and populates `Auth-\u003eUser()` using the `Bearer [token]` value from that header. (This is instead of the stock AuthComponent's default operation of looking up data from an active `$_SESSION` on repeat connections using the cookie provided by the browser.) It supports plug-able Authenticate and Authorize objects, and the package includes a few that may be of use.\n\n:warning: This is still unstable software and probably not suitable for public use yet.\n\n\n## Requirements\n\n* PHP \u003e= 5.4.0\n* CakePHP \u003e= 2.6\n\n\n## Installation\n\n### Composer\n\n* Run this shell command\n\n````bash\n$ composer require loadsys/cakephp-stateless-auth:dev-master\n````\n\n### Setup\n\nLoad the plugin and be sure that bootstrap is set to true:\n\n```php\n// Config/boostrap.php\nCakePlugin::load('StatelessAuth', array('bootstrap' =\u003e true));\n// or\nCakePlugin::loadAll(array(\n\t'StatelessAuth' =\u003e array('bootstrap' =\u003e true),\n));\n```\n\nThe [CakePHP book has more information on doing REST APIs](http://book.cakephp.org/2.0/en/development/rest.html) with CakePHP and this feature.\n\n\n## Sample Usage\n\nIn your project's `AppController`, change your `$components` array to use this plugin's StatelessAuthComponent, but alias it to allow access by the common name:\n\n\n```php\n\tpublic $components = array(\n\t\t'Auth' =\u003e array(\n\t\t\t'className' =\u003e 'StatelessAuth.StatelessAuth',\n\t\t\t'authenticate' =\u003e array(\n\t\t\t\t'className' =\u003e 'StatelessAuth.Token',\n\n\t\t\t\t// Additional examples:\n\n\t\t\t\t// 'userModel' =\u003e 'User',\n\t\t\t\t// 'tokenField' =\u003e 'token',\n\t\t\t\t// 'recursive' =\u003e -1,\n\t\t\t\t// 'contain' =\u003e array('Permission'),\n\t\t\t\t// 'conditions' =\u003e array('User.is_active' =\u003e true),\n\t\t\t\t// 'passwordHasher' =\u003e 'Blowfish',\n\t\t\t),\n\t\t),\n\t\t'Paginator',\n\t\t'DebugKit.Toolbar',\n\t);\n```\n\nHow you authenticate your requests to your Cake app is up to you. If you use the bundled `TokenAuthenticate` object as demonstrated above, you must include an `Authorization` header in your request that includes a `Bearer [token]` that matches a valid token in your User table. The token represents the User's login session, in effect replacing `$_SESSION`. A sample HTTP request might look like the following:\n\n```\nGET /users/view HTTP/1.1\nHost: vagrant.dev:80\nAuthorization: Bearer 0193d044dd2034bfdeb1ffa33c5fff9b\n```\n\n:warning: Just like normal Auth, the token will be sent in the clear and could be intercepted and re-used, so be sure to secure your connections using SSL.\n\n`TokenAuthenticate` will attempt to look up a User record using the provided token. You can define the name of your User model to query and the name of the token field to check in the component configuration as shown above.\n\nThe StatelessAuthComponent uses this authenticate object by default.\n\n\nYou will still access the Component as usual In your controllers:\n\n```php\n\t/**\n\t * Allow the logged-in User to view their own record.\n\t *\n\t * @return void\n\t * @throws NotFoundException If the passed id record does not exist\n\t */\n\tpublic function view() {\n\t\t$id = $this-\u003eAuth-\u003euser('id'); // \u003c-- Populated by the stateless auth component.\n\t\tif (!$id) {\n\t\t\tthrow new NotFoundException(__('Please log in to view your User record.'));\n\t\t}\n\t\t$options = array(\n\t\t\t'conditions' =\u003e array(\n\t\t\t\t'User.' . $this-\u003eUser-\u003eprimaryKey =\u003e $id,\n\t\t\t),\n\t\t);\n\t\t$user = $this-\u003eUser-\u003efind('first', $options);\n\t\t$this-\u003eset(compact('user'));\n\t}\n```\n\nYou must define an `::isAuthorized($user)` method either in each controller or your `AppController` that returns true or false based on whether the current `Auth-\u003euser()` should be allowed to access the current controller action.\n\nIf you wish for all authenticated Users to have access to all methods, you can place the following in your project's AppController:\n\n```php\n\tpublic function isAuthorized($user) {\n\t\treturn true;\n\t}\n```\n\nAlternatively, you can supply your own authorization object to perform the appropriate checks yourself. See Cake's cookbook section on [Authorization](http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#authorization) for details.\n\n## Error and Exception Handling Setup\n\nErrors and Exceptions are handled via a separate CakePHP plugin, \nincluded via Composer: [SerializersErrors](https://github.com/loadsys/CakePHP-Serializers-Errors)\n\nPlease read the documentation there for more information on the specifics.\n\nModify your `app/Config/core.php` file to use the Custom Exceptions/Error\nhandling in SerializersErrors.\n\n``` php\nConfigure::write('Exception', array(\n\t'handler' =\u003e 'ErrorHandler::handleException',\n\t'renderer' =\u003e 'SerializersErrors.SerializerExceptionRenderer',\n\t'log' =\u003e true,\n));\n```\n\nThis does two things:\n\n* Errors and Exceptions get output as correctly formatted JSON API, JSON or HTML \ndepending on the request type\n* Allows the use of Custom Exceptions that match Ember Data exceptions for error cases\n* The classes in this plugin use this format to enable easier use for API Authentication Handling\n\n### Swapping authentication and authorization objects\n\nThe project comes with additional Auth objects that can be used to extend the functionality surrounding HTTP header authentication. The `TokenLoginLogoutAuthenticate` object, for example, allows you to hook callback behavior into the `Auth-\u003elogin()` and `Auth-\u003elogout()` processes to perform additional Model operations.\n\nSee `Controller/Component/Auth/TokenLoginLogoutAuthenticate.php`, specifically `::requireUserModelMethods()` for details and expected method signatures.\n\n@TODO: Write up proper documentation on the callback methods needed.\n\n\n\n## Contributing\n\n### Reporting Issues\n\nPlease use [GitHub Isuses](https://github.com/loadsys/CakePHP-Stateless-Auth/issues) for listing any known defects or issues.\n\n### Development\n\nWhen developing this plugin, please fork and issue a PR for any new development.\n\nThe Complete Test Suite for the Plugin can be run via this command:\n\n`./lib/Cake/Console/cake test StatelessAuth AllStatelessAuth`\n\n## License\n\n[MIT](https://github.com/loadsys/CakePHP-Stateless-Auth/blob/master/LICENSE.md)\n\n\n## Copyright\n\n[Loadsys Web Strategies](http://www.loadsys.com) 2015\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Floadsys%2Fcakephp-stateless-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Floadsys%2Fcakephp-stateless-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Floadsys%2Fcakephp-stateless-auth/lists"}