Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/udarajay/dunbar
Easy to use (thin) proxy for your Laravel APIs. (Works seamlessly with Passport).
https://github.com/udarajay/dunbar
laravel oauth passport proxy
Last synced: about 2 months ago
JSON representation
Easy to use (thin) proxy for your Laravel APIs. (Works seamlessly with Passport).
- Host: GitHub
- URL: https://github.com/udarajay/dunbar
- Owner: UdaraJay
- License: other
- Created: 2019-10-30T01:00:44.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2019-10-30T06:10:08.000Z (about 5 years ago)
- Last Synced: 2024-04-10T04:49:16.742Z (9 months ago)
- Topics: laravel, oauth, passport, proxy
- Language: PHP
- Homepage:
- Size: 53.7 KB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
Dunbar
Easy to use (thin) proxy for your Laravel APIs.
[](https://packagist.org/packages/udarajay/dunbar)
[](https://packagist.org/packages/udarajay/dunbar)
[](https://packagist.org/packages/udarajay/dunbar)
If you're consuming your Laravel API from any public client, like a single-page web app or a mobile/desktop app, chances are you're going to have to store the `client-secret` credentials somewhere in there. It's super easy for anyone to inspect you code and grab your secure tokens.
Using a 'thin' (server-side) proxy is the fastest way to secure your client APIs; simply put, this poxy will sit between your frontend clients and backend apis. Where you would normally make an authentication call to the API with a `client-id` and `client-secret` like so:
```http
POST /auth HTTP/1.1
Host: api.example.com
grant_type=password
&client_id=webapp
&client_secret=a-secret-code-no-one-should-see
&username=admin
&password=password
```
You'd now be making the same API call to the proxy endpoint, in our case `example.com/dunbar`, **minus the client-secret**. The proxy will take the request, add the `client-secret` and forward the request to your backend API.
The server would **normally** respond with the access tokens and refresh tokens like so:
```json
{
"access_token": "Jcncdj32CXdsdiUYtxnt6H8vCjndiCbdsu",
"refresh_token": "83JCd97cdkalc53nB2DHJui3d83NcdicS",
"token_type": "Bearer",
"expires": 1535645629
}
```
But with our thin proxy, it'll simply create an encrypted cookie that only the proxy can decrypt.
Now, for all future call to the API:
```http
GET /ajax/resource/123 HTTP/1.1
Cookie:
Host: example.com
```
The `proxy` will decrypt the cookie, add the Authorization header to the request and forward it on to the API like so:
```http
GET /resource/some-protected-resource HTTP/1.1
Authorization: Bearer the-access-token-form-the-cookie
Host: api.example.com
```
The responses will be passed directly back to the browser or app exactly like you define in your API.
### So what exactly does this "thin" proxy do?
Simply put, the proxy lets you hard code the client-secret credentials into this thin server-side component (proxy) that you can trust. It authenticates your client APIs for you and returns an encrypted cookie with the user credentials (eg. access token) that only the proxy can decrypt. All you need to do to access protected resources after you've authenticated via the proxy is to pass this cookie with all your calls.
### What more?
Teh further secure your API, you can lock it down to only accept requests from the proxy. Additionally you can also roll your client-secret on a schedule or anytime you need to without having to update any front-end clients.
## Installation
1. Install `Dunbar` via composer
```
composer require udarajay/dunbar
```
2. Publish the configuration
```
php artisan vendor:publish
```
3. Edit the file `app/config/dunbar.php` to suit your needs. Primarily you can edit it to change the name of the cookie and the proxy endpoint.
You may also need to regenrate your route and config cache on Laravel using `php artisan config:clear` and `php artisan route:cache`.
## Usage
The package will automatically register a proxy endpoint (default being `yourdomain.com/dunbar`). Make all your API calls to the proxy endpoint like so to authenticate:
```http
POST dunbar/example.com/oauth/token HTTP/1.1
Host: example.com
&grant_type=password
&client_id=webapp
&username=admin
&password=mypassword
```
And requests to all protected resources like so:
```http
POST dunbar/example.com/protected_resource HTTP/1.1
Host: example.com
```
If the `access_token` expires and you have got a `refresh_token`, `Dunbar` will call the OAuth server for you and refresh the `access_token` with a new one and update the cookie.
## Features
* Dead-simple proxy for securing your Laravel API. Works seamlessly with Passport or the League OAuth2 server that is maintained by Andy Millington and Simon Hamp.
* [ Upcoming] Interact with database (Passport defaults first), to access client secrets directly from the OAuth provider.
* [ Upcoming] Auto-roll client secrets on a schedule.
## Questions?
Create an issue and tag it with `question`. I'll try to help & answer best I can.
## Contribute?
Please do :)
Just create a PR.
## License
This package is released under the MIT License.