CSRF in a HTML App using Laravel Routes - javascript

I'm developing an app using the PhoneGap API but the problem is it takes over the 'View' property of Laravel.
The other problem is the index file must be .html so i'm unsure of how to secure user requests. Usually I would have the csrf meta tag in the header but in this case I am unable to save the csrf_token() in the meta tag as PHP can't run in the HTML file.
I was thinking maybe something like cookies would be best to secure the requests to the different routes (post/get requests) but am still quite unsure of how I would achieve this.
The general functionality of my phone application would be making use of POST and GET methods which retrieve and add data to the controllers (i.e. Signing a user up)
What are the different options I could make use of to secure my application requests using Javascript/HTML as a connection to Laravel Controllers?

Did you try with api_token? Actually app requests need not to be csrf protected once you authenticate api requests via api_token. Generate an unique api_token for each of your user. Wrap your api routes with api middleware. Append this token in every api request via GET parameter / Authorization header / as an auth password.
This article might be helpful. How touse API tokens for authentication in Laravel

Related

How to refresh and pass a token with every request whether server side or client side in sveltekit

I am building a simple app where users can read blogs written by authors. These blogs are fetched from an express backend that implements HMAC authentication. Every client app gets an appID and appSecret. Using this secret, the client creates a signature for every request and sends it in the Auth header.
Now, I am trying to figure out what is the correct method to add this Auth header with every request whether server-side or client-side. This works when I do fetch client-side in onMount, but the Auth header is missing for requests that originate from the load method in SSR.
Is this related to the below issue?
https://github.com/sveltejs/kit/issues/696
If yes, is there a workaround? Because this is a blocker for me.
All my load methods route requests through a common api.js module. I have tried modifying the header in api.js, in handle hooks but no success.

Can i have Django urls and Vue routes in the same project?

I started a Django app and i created the whole authentication layer using Django-Allauth, it already has quite some features such as email confirmation, password reset and two factor authentication. Now i realized that, since my app will be heavily interactive and with a lot of real time features, i'm going to need a Vue SPA to use with Django, so i'm thinking of creating the Vue SPA on the same server and domain and have Django as a Rest API.
Here is my problem: since i already made the whole authentication part using Django templates and Django urls, if i separate the rest of the frontend from the backend, will i have to rewrite everything? Is it possible to have a Vue app and a Django backend app separated on the same domain where authentication is handled by Django templates and all the rest is a Vue app with vue routes and all the other interactions are handled by Django Rest Framework endpoints?
So maybe something like this:
urlpatterns = [
path('accounts/signup/', SignUpView.as_view(), name='signup'), #Django template
path('accounts/login/', LoginView.as_view(), name='login'), #Django template
...
]
And these are the only Django-handled urls where the page is rendered by Django views. Once the user is logged in, they will be redirected to the VueJS app.
My personal opinion, it's not worth it to keep a bunch of server side pages just for sign-up, login, ... Managing both server-side pages and front-end pages in long run is a headache. But if you like that way, here are my suggestions.
For authentication, use Django auth. No matter if it's a server side HTML page or it's an API end-point. Django auth is simple and secure. Don't roll your own auth, don't store tokens in localstorage or so.
Fully separate these 3:
Front-end URLs (i.e. routes stored in Vue)
Back-end page URLs (i.e. HTML pages severd by Django)
Back-end API end-points URLs (i.e. the ones user never see, only Vue uses them under the hood)
They can be on separated domains but it can be just by a path prefix as well. As you yourself suggested in a comment.
Now when user visits some page in BE, it will use server side rendering and every user click is a browser refresh. Until you hit a FE URLs, then your front proxy should redirect user to FE or you'll serve JS files directly from Django. After that every user click is handled inside Vue without a refresh. If user hits a URL prefix that's for BE, then FE needs to do something like document.location = "/server-side/some-page.
BTW few days ago I answered another question that was similar to this, maybe you find the answer or comments there useful.
So in order to log in from the SPA i need to send a csrf token, and in order to get the token i can create a Django view that returns a CSRF token to the user so that it can be used to login. Wouldn't it provide attackers a way to attack my server (stackoverflow.com/questions/43567052/…)
My suggestion is to turn CSRF protection off and instead make session cookie samesite=Lax (I think that's default in newer versions of Django). All major browsers support this and it prevents CSRF.
Otherwise you can read token from another API or from cookie like here
So on production i will use Nginx to have the Vue app and the Django backend app on the same server and domain, but on development how can i do that? If i run the two apps on different terminals, won't django consider the Vue app to be in a different server?
It can't understand what server it is. The only thing you should care is the domain of the cookie. It should be set on your BE domain. When running on local both FE and BE are running on domain "localhost" so there should be no issue.

How to refresh token with different endpoint?

I have an Ember app in which I use ember-simple-auth for authentication. My backend is structure in a way that the endpoint for authorization is different from the endpoint for refreshing.
How can I specify a different endpoint for refreshing? So far, I only found serverTokenEndpoint which specifies both auth and refreshing endpoints at once.
Have you checked out https://github.com/jpadilla/ember-simple-auth-token? It's an extension to ember-simple-auth that abstracts some of the token work out and includes a specific configuration for serverTokenRefreshEndpoint. We've been happy using it happily for years.

NextJS auth with an external server

I'm working with auth in Nextjs, I'm wondering what is the best strategy to handle authentication in NextJS ?
Here my services structure :
If I understand well I have to handle the server side rendering in NextJS, so I understand I have to put cookies from my external server to my NextJS client, then handle the server side rendering checkings. To do that I assume I have to create connection between the NextJS server and the other services. Before dive more deeper in the subject I would discuss with you about the possibilities available to me. It seems the NextJS auth is a subject in plain development.
Any hint would be great,
Thanks
I've recently added an example with cookie auth which explains what you are trying to do on the frontend.
For the backend, optimally you'll have your API in an external server, apart from the server you use for rendering your Next.js app. This API will handle the database and the token creation business. Then the basics of the authentication are like this:
The client POST a request with username and password to the server.
The server gets the request and generate a token based on the data received.
If everything went okay validating the data, the server responds with the token, e.g., { token: "secrettoken" }.
The client receives the token and saves it in a cookie. Optionally you redirect the user to the /dashboard or /profile if everything is okay.
The client, on restricted pages, will check if the cookie exists and optionally validate that against the server, you do this last part in getInitialProps. If the cookie validation fails you redirect the user away.
I've created a small library to abstract this logic.
So in the end, your Next.js app shouldn't know what's happening in the server, it only should receive the token, save it, validate it, and redirect the user if something is wrong.
How you want to handle the token creation, on the external server, is up to you.
Check out this thread. There are several examples of how to do Authentication with JWT, OAuth etc throughout the thread. You'll see that the examples are utilizing getInitialProps and there are several examples utilizing cookies throughout to extract the Authentication tokens.
You'll have to write a custom server.js file using express.js to serve the tokens through your route requests. I'm assuming by "external server" you mean some third party Authenticator using OAuth or OpenId protocols to retrieve tokens. If so, you're right to say that you'll need to request the tokens (or Authentication mechanism) from those external services and then decide how you're going to utilize them in your own client. You'll probably be using getInitialProps to do what you need to do with your Authentication tokens in the client once you are rendering to the browser.
More examples of Authentication here -- one for firebase and another for Apollo.
Just to add to the answers if you want to use Auth0 specifically. In the interview on http://www.fullstackradio.com/112 around the 1:06 min mark Guillermo Rauch mentioned that if he were to implement authentication all over again he would use Auth0, so I created a minimal repo using Auth0 and Nextjs with Serverless functions.
Like #jolvera suggested there is an API in an external server, apart from the server used for rendering the Next.js app. This API is located in ./auth/auth.js. It handles the token creation business, and could be extended to handle the database.
The HOC component in ./utils/withAuth.js calls the auth.js lambda for the user information, and is only able to retrieve it if the client side is authorized. Otherwise the user information is undefined. Additionally there is an event listener similar to the one in with-cookie-auth which syncs logouts across tabs.
Also one other note, don't get confused with the Nextjs example on Auth0's blog. That example is extending the Nextjs server, and isn't the solution you want if you are deploying Next to serverless. It doesn't have the separation of concerns with page routing and authentication.

IdentityServer Authentication AspCore and Angular Client bestpractice

Given:
Asp MVC Core Client
JavaScript client hosted by ASP MVC Core
Asp Web Api
All are authenticating with IdentityServer
Problem
For a normal user the auth is done with asp core and the oidc client. I use the access token in asp core to access the api.
Now a javascript function wants to access the an authorized api and needs for this the access_token.
What is the best practice to have it in javascript
I see primarily two option
1.) I make a "silent" auth in javascript with a oidc client . (Feels like duplicate work)
2.) I store the access_token in a cookie where javascript could pick it up ( pot. unsecured)
3.) (Feels like a smell) Making an authorized endpoint like /me/token returning the access_token
What is the intended way in this scenario ?
You could render on an MVC view a script tag which configures your AJAX headers so you can add the authorization header with the access_token you have in MVC.
Tokens are secure due the facted they are signed so you can change them without knowing the key to sign and limited in time. Also tokens need to be verified before you should use them.

Categories