/**
* Get the token for the current request.
*
* @return string
*/
protected function getTokenForRequest()
{
$token = $this->request->input($this->inputKey);
if (empty($token)) {
$token = $this->request->bearerToken();
}
if (empty($token)) {
$token = $this->request->getPassword();
}
return $token;
}
/**
* Get the token for the current request.
*
* @return string
*/
public function getTokenForRequest()
{
$token = $this->request->input($this->inputKey);
if (empty($token)) {
$token = $this->request->bearerToken();
}
return $token;
}
public function authenticate(Request $request, Route $route)
{
if (!$request->bearerToken() || empty($request->bearerToken())) {
throw new UnauthorizedHttpException('The authentication header was missing or malformed');
}
list($public, $hashed) = explode('.', $request->bearerToken());
$key = APIKey::where('public', $public)->first();
if (!$key) {
throw new AccessDeniedHttpException('Invalid API Key.');
}
// Check for Resource Permissions
if (!empty($request->route()->getName())) {
if (!is_null($key->allowed_ips)) {
$inRange = false;
foreach (json_decode($key->allowed_ips) as $ip) {
if (Range::parse($ip)->contains(new IP($request->ip()))) {
$inRange = true;
break;
}
}
if (!$inRange) {
throw new AccessDeniedHttpException('This IP address <' . $request->ip() . '> does not have permission to use this API key.');
}
}
foreach (APIPermission::where('key_id', $key->id)->get() as &$row) {
if ($row->permission === '*' || $row->permission === $request->route()->getName()) {
$this->permissionAllowed = true;
continue;
}
}
if (!$this->permissionAllowed) {
throw new AccessDeniedHttpException('You do not have permission to access this resource.');
}
}
try {
$decrypted = Crypt::decrypt($key->secret);
} catch (\Illuminate\Contracts\Encryption\DecryptException $ex) {
throw new HttpException('There was an error while attempting to check your secret key.');
}
$this->url = urldecode($request->fullUrl());
if ($this->_generateHMAC($request->getContent(), $decrypted) !== base64_decode($hashed)) {
throw new BadRequestHttpException('The hashed body was not valid. Potential modification of contents in route.');
}
return true;
}
/**
* Get the token for the given request.
*
* @param Request $request
* @return Token|string
*/
protected function getTokenFromRequest(Request $request)
{
$bearer = $request->bearerToken();
// First we will check to see if the token is in the request input data or is a bearer
// token on the request. If it is, we will consider this the token, otherwise we'll
// look for the token in the cookies then attempt to validate that it is correct.
if ($token = $request->input('api_token', $bearer)) {
return $token;
}
if ($request->cookie('kodicms_token')) {
return $this->getTokenFromCookie($request);
}
}
/**
* Get the token for the current request.
*
* @return \Lcobucci\JWT\Token
*/
protected function getTokenForRequest()
{
$token = $this->request->bearerToken();
if (empty($token)) {
return null;
}
try {
$token = (new Parser())->parse($token);
if (!$this->signer->verify($token)) {
return null;
}
} catch (InvalidArgumentException $e) {
return null;
}
return $token;
}
public function isAuthenticated(Request $request)
{
$token = $request->bearerToken();
if (null === $token) {
$token = $request->cookie(config('stormpath.web.accessTokenCookie.name'));
}
if ($token instanceof \Symfony\Component\HttpFoundation\Cookie) {
$token = $token->getValue();
}
try {
(new \Stormpath\Oauth\VerifyAccessToken(app('stormpath.application')))->verify($token);
return true;
} catch (\Exception $re) {
return false;
}
}
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
*
* @return mixed
*/
public function handle(Request $request, Closure $next)
{
if (!($token = $request->bearerToken())) {
throw new InvalidTokenAuthorizationHeader();
}
// Validate the vadility of the token
try {
$payload = $this->manager->setRefreshFlow($this->getRefreshFlow())->decode(new Token($token));
} catch (\Exception $e) {
throw new InvalidToken();
}
if (!$this->auth->onceUsingId($payload->get('sub'))) {
throw new InvalidUser();
}
return $next($request);
}
/**
* Get the bearer token from the request headers.
*
* @return string|null
* @static
*/
public static function bearerToken()
{
return \Illuminate\Http\Request::bearerToken();
}
