Merge pull request #23 from cristianopacheco/add-throttles-logins

Add Login Throttling.

Author: vedovelli

webservice/app/Http/Controllers/LoginController.php

@@ -2,30 +2,64 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\ThrottlesLogins;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Auth;
-use JWTException;
+use Lang;
 
 class LoginController extends Controller
 {
+    use ThrottlesLogins;
+
     public function login(Request $request)
     {
-        // grab credentials from the request
+        if ($this->hasTooManyLoginAttempts($request)) {
+            $this->fireLockoutEvent($request);
+
+            return $this->sendLockoutResponse($request);
+        }
+
         $credentials = $request->only('email', 'password');
 
-        try {
-            // attempt to verify the credentials and create a token for the user
-            if (!$token = Auth::guard('api')->attempt($credentials)) {
-                return response()->json(['messages' => ['E-mail ou senha não conferem']], 401);
-            }
-        } catch (JWTException $e) {
-            // something went wrong whilst attempting to encode the token
-            return response()->json(['messages' => ['Não foi possível gerar o token']], 500);
+        if ($token = Auth::guard('api')->attempt($credentials)) {
+            return $this->sendLoginResponse($request, $token);
         }
 
+        $this->incrementLoginAttempts($request);
+
+        return $this->sendFailedLoginResponse($request);
+    }
+
+    protected function sendLoginResponse(Request $request, $token)
+    {
+        $this->clearLoginAttempts($request);
+
         $user = Auth::guard('api')->user();
 
-        // all good so return the token
         return response()->json(compact('token', 'user'));
     }
+
+    protected function sendFailedLoginResponse(Request $request)
+    {
+        $message = Lang::get('auth.failed');
+
+        return response()->json(['messages' => [$message]], 401);
+    }
+
+    public function sendLockoutResponse(Request $request)
+    {
+        $seconds = $this->limiter()->availableIn(
+            $this->throttleKey($request)
+        );
+
+        $message = Lang::get('auth.throttle', ['seconds' => $seconds]);
+
+        return response()->json(['messages' => [$message]], Response::HTTP_TOO_MANY_REQUESTS);
+    }
+
+    public function username()
+    {
+        return 'email';
+    }
 }

webservice/app/Http/Kernel.php

@@ -52,8 +52,6 @@ class Kernel extends HttpKernel
         'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
         'can' => \Illuminate\Auth\Middleware\Authorize::class,
         'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
-        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
-        'jwt.auth' => \Tymon\JWTAuth\Middleware\GetUserFromToken::class,
-        'jwt.refresh' => \Tymon\JWTAuth\Middleware\RefreshToken::class,
+        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class
     ];
 }

webservice/app/Providers/EventServiceProvider.php

@@ -26,20 +26,5 @@ class EventServiceProvider extends ServiceProvider
     public function boot()
     {
         parent::boot();
-
-        Event::listen('tymon.jwt.absent', function () {
-            return response()->json(
-                ['reason' => 'token', 'messages' => ['Token not provided']], 400);
-        });
-
-        Event::listen('tymon.jwt.expired', function () {
-            return response()->json(
-                ['reason' => 'token', 'messages' => ['Expired Token']], 400);
-        });
-
-        Event::listen('tymon.jwt.invalid', function () {
-            return response()->json(
-                ['reason' => 'token', 'messages' => ['Invalid Token']], 400);
-        });
     }
 }

webservice/routes/api.php

@@ -1,10 +1,8 @@
 <?php
 
-use Illuminate\Http\Request;
-
 Route::group(['middleware' => ['cors', 'api']], function () {
     Route::post('login', ['uses' => 'LoginController@login']);
-    Route::group(['middleware' => 'jwt.auth'], function () {
+    Route::group(['middleware' => 'auth:api'], function () {
         Route::group(['prefix' => 'categories'], function () {
             Route::get('', ['uses' => 'CategoriesController@all']);
             Route::get('{id}/get', ['uses' => 'CategoriesController@get']);