Laravel Basic application authentication

[RizaHKhan]

You may not be able to help me with this so please feel free to disregard.

There are many ways to authenticate using Kulala, but I'm having a difficult time wrapping my head around authenticating with a Laravel application that uses basic browser based authentication.

I can't simply send a request to /login with the credentials because I believe it uses cookies in the browser. Am I overlooking something or have I completely misunderstood browser based authentication?

[YaroSpace]

Browser based auth can be implemented in a number of ways - through a form with login/password that gets sent with a POST request or request that sends the credentials in the Authorizaton header of the request, like Basic/Digets Auth.
Cookies are not usually used for authentication itself, but to store a session id.
So, depends what that app expects. Is it available publicly to have a look?

[RizaHKhan]

Laravel is PHP based and you can find installation instructions here: https://laravel.com/docs/12.x/installation

Once you have Laravel installer installed:

laravel new example-app

Select 'Laravel based authentication option'.

Once everything is done, composer run dev.

You can then register and login to the application (the db by default is Sqlite) so you are up and running in seconds really.

So the original question is, can you do that login process via Kulala (or any REST client)?

[YaroSpace]

I am pretty sure you can. Let me have a look. Have not touched php in 22 years :)

[YaroSpace]

### Login_page

GET localhost:8000/login

> {%
   -- lua
   client.global.token = vim.uri_decode(response.cookies["XSRF-TOKEN"].value)
%}


### 

run #Login_page

POST localhost:8000/login
Content-Type: application/json
X-Xsrf-Token: {{token}}
Cookie: XSRF-TOKEN={{Login_page.response.cookies.XSRF-TOKEN.value}}
Cookie: laravel_session={{Login_page.response.cookies.laravel_session.value}}
Referer: http://localhost:8000/login

{
  "email": "[email protected]",
  "password": "pass",
  "remember": false
}

[YaroSpace]

Slightly cleaner version:

### Acquire_XSRF_TOKEN

GET localhost:8000/login


### Authentication

run #Acquire_XSRF_TOKEN

< {%
  -- lua
  request.environment.token = client.responses.Acquire_XSRF_TOKEN.cookies["XSRF-TOKEN"].value
  request.environment.decoded_token = vim.uri_decode(request.environment.token)
  request.environment.session = client.responses.Acquire_XSRF_TOKEN.cookies["laravel_session"].value
%}

POST localhost:8000/login
Content-Type: application/json
X-Xsrf-Token: {{decoded_token}}
Cookie: XSRF-TOKEN={{token}}
Cookie: laravel_session={{session}}
Referer: http://localhost:8000/login

{
  "email": "[email protected]",
  "password": "pass"
}

[riza-khan]

@YaroSpace , wow this is quite a bit to take in (I would probably not have been able to figure that out). Thank you so much.

Before I go heads down and try to understand this:

So I get redirected to the dashboard:

But if I try to hit the /dashboard endpoint, it says unauthenticated.

Would you know why that is happening?

### Dashboard

GET localhost:8000/dashboard
Content-Type: application/json
accept: application/json
X-Xsrf-Token: {{decoded_token}}
Cookie: XSRF-TOKEN={{token}}
Cookie: laravel_session={{session}}

Request: 38/38  Code: 0  Duration: 43.87 ms  Time: Jun 16 09:18:58
URL: GET localhost:8000/dashboard  Status: 401  Assert: -
Buffer: http.http::33

{
  "message": "Unauthenticated."
}

[YaroSpace]

Most likely, the session cookie gets updated after authentication, so it needs to be re-saved.

[YaroSpace]

You should be also getting an error variable token/session/decoded_token not found in the document.
That's because we are saving the variables in the request scope with request.environment.., so they are only available within the same request.

Better do this:

### Acquire_XSRF_TOKEN

GET localhost:8000/login

> {%
  -- lua
  client.global.token = response.cookies["XSRF-TOKEN"].value
  client.global.decoded_token = vim.uri_decode(client.global.token)
  client.global.session = response.cookies["laravel_session"].value
%}

### Authentication

run #Acquire_XSRF_TOKEN

POST localhost:8000/login
Content-Type: application/json
X-Xsrf-Token: {{decoded_token}}
Cookie: XSRF-TOKEN={{token}}
Cookie: laravel_session={{session}}
Referer: http://localhost:8000/login

{
  "email": "[email protected]",
  "password": "passpass"
}

> {%
  -- lua
  -- save the new set authenticated session
  client.global.session = response.cookies["laravel_session"].value
%}

### Dashboard

run #Acquire_XSRF_TOKEN
run #Authentication

GET http://localhost:8000/dashboard
Cookie: laravel_session={{session}}

this way, with client.global.. the variables are saved in global context and will be available between requests.

You can now run the Dashboard request and it will in turn run Acquire and Authentication

[RizaHKhan]

You are simply awesome man. Thank you so much.

[YaroSpace]

No problem at all! Always glad to help and to use Kulala in some new usecase.

[RizaHKhan]

Do you think this is a bug worth reporting (it is very annoying):

<leader>Rf:

You can see it listed, but when you select it, it actually go to the wrong request:

What I usually do to fix this is change the position of the calls.

[YaroSpace]

Yeah, it is annoying. Currently, when you have run commands, the referenced requests cannot be run directly.
I will fix that asap.

[gorillamoe]

What a legend! @YaroSpace keeps pumping out new content and fixes every day! Thanks for you hard work @YaroSpace! ❤️