Skip to content

Commit dcd0082

Browse files
mevdscheemevdschee
committed
Merge branch 'master' of github.com:mevdschee/php-crud-api
2 parents db97c75 + 1b9b0dc commit dcd0082

File tree

7 files changed

+49
-12
lines changed

7 files changed

+49
-12
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ https://github.com/mevdschee/php-crud-api/tree/v1
77

88
Related projects:
99

10-
- [PHP-API-AUTH](https://github.com/mevdschee/php-api-auth): Authentication add-on (for v1) supporting JWT or username/password.
10+
- [PHP-API-AUTH](https://github.com/mevdschee/php-api-auth): Authentication add-on supporting JWT for username/password.
1111
- [PHP-SP-API](https://github.com/mevdschee/php-sp-api): Single file PHP script that adds a REST API to a SQL database.
1212
- [PHP-CRUD-UI](https://github.com/mevdschee/PHP-crud-ui): Single file PHP script that adds a UI to a PHP-CRUD-API (v1) project.
1313
- [VUE-CRUD-UI](https://github.com/nlware/vue-crud-ui): Single file Vue.js script that adds a UI to a PHP-CRUD-API (v1) project.

‎api.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3117,7 +3117,7 @@ public function handle(Request $request): Response
31173117
$response = $this->responder->error(ErrorCode::ORIGIN_FORBIDDEN, $origin);
31183118
} elseif ($method == 'OPTIONS') {
31193119
$response = new Response(Response::OK, '');
3120-
$allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN');
3120+
$allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization');
31213121
if ($allowHeaders) {
31223122
$response->addHeader('Access-Control-Allow-Headers', $allowHeaders);
31233123
}

‎examples/clients/auth.php/vanilla.html

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<html>
2+
<head>
3+
<meta charset="utf-8" />
4+
<script>
5+
var authUrl = 'authorize.php'; // hostname ending in '.auth0.com'
6+
var clientId = 'default'; // client id as defined in auth0
7+
var audience = 'api.php'; // api audience as defined in auth0
8+
window.onload = function () {
9+
var match = RegExp('[#&]access_token=([^&]*)').exec(window.location.hash);
10+
var accessToken = match && decodeURIComponent(match[1].replace(/\+/g, ' '));
11+
if (!accessToken) {
12+
document.location = authUrl+'?audience='+audience+'&response_type=token&client_id='+clientId+'&redirect_uri='+document.location.href;
13+
} else {
14+
document.location.hash = '';
15+
var req = new XMLHttpRequest();
16+
req.onreadystatechange = function () {
17+
if (req.readyState==4) {
18+
console.log(req.responseText);
19+
document.getElementById('output').innerHTML = JSON.stringify(JSON.parse(req.responseText), undefined, 4);
20+
}
21+
}
22+
url = 'api.php/records/posts?join=categories&join=tags&join=comments&filter=id,eq,1';
23+
req.open("GET", url, true);
24+
req.setRequestHeader('X-Authorization', 'Bearer '+accessToken);
25+
req.send();
26+
}
27+
};
28+
</script>
29+
</head>
30+
<body>
31+
<pre id="output"></pre>
32+
</body>
33+
</html>

‎examples/clients/auth0/vanilla.html

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,9 @@
22
<head>
33
<meta charset="utf-8" />
44
<script>
5-
//var domain = ''; // hostname ending in '.auth0.com'
6-
//var authUrl = 'https://'+domain+'/authorize';
7-
var authUrl = 'http://127.0.0.2/authorize.php'
8-
var clientId = 'default'; // client id as defined in auth0
9-
var audience = 'http://127.0.0.3/api.php'; // api audience as defined in auth0
5+
var authUrl = 'https://php-crud-api.auth0.com/authorize'; // hostname ending in '.auth0.com'
6+
var clientId = ''; // client id as defined in auth0
7+
var audience = ''; // api audience as defined in auth0
108
window.onload = function () {
119
var match = RegExp('[#&]access_token=([^&]*)').exec(window.location.hash);
1210
var accessToken = match && decodeURIComponent(match[1].replace(/\+/g, ' '));
@@ -32,4 +30,4 @@
3230
<body>
3331
<pre id="output"></pre>
3432
</body>
35-
</html>
33+
</html>

‎src/Tqdev/PhpCrudApi/Middleware/CorsMiddleware.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ public function handle(Request $request): Response
3232
$response = $this->responder->error(ErrorCode::ORIGIN_FORBIDDEN, $origin);
3333
} elseif ($method == 'OPTIONS') {
3434
$response = new Response(Response::OK, '');
35-
$allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN');
35+
$allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization');
3636
if ($allowHeaders) {
3737
$response->addHeader('Access-Control-Allow-Headers', $allowHeaders);
3838
}

‎src/Tqdev/PhpCrudApi/Middleware/JwtAuthMiddleware.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,14 @@ private function getVerifiedClaims(String $token, int $time, int $leeway, int $t
3838
}
3939
foreach ($requirements as $field => $values) {
4040
if (!empty($values)) {
41-
if (!isset($claims[$field]) || !in_array($claims[$field], $values)) {
42-
return array();
41+
if ($field == 'alg') {
42+
if (!isset($header[$field]) || !in_array($header[$field], $values)) {
43+
return array();
44+
}
45+
} else {
46+
if (!isset($claims[$field]) || !in_array($claims[$field], $values)) {
47+
return array();
48+
}
4349
}
4450
}
4551
}

‎tests/functional/001_records/041_cors_pre_flight.log

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Access-Control-Request-Method: POST
44
Access-Control-Request-Headers: X-XSRF-TOKEN, X-Requested-With
55
===
66
200
7-
Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN
7+
Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN, X-Authorization
88
Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST, DELETE, PATCH
99
Access-Control-Allow-Credentials: true
1010
Access-Control-Max-Age: 1728000

0 commit comments

Comments
 (0)