Laravel 5: activate API token guard and print “Unauthorized” instead of login redirect

In Laravel 5, I wrap my API routes in a route group like this:

Route::group([‘middleware’ => [‘auth:api’,’throttle’]], function() {
    // API routes here
});

1

2

3

Route::group([‘middleware’ => [‘auth:api’,‘throttle’]], function() {

// API routes here

});

Notice that I use auth:api and throttle on my middleware array.

auth:api turns on the auth middleware with API token as guard, while throttle activates rate limiter for APIs.

To get started with API token authentication, you may read https://gistlog.co/JacobBennett/090369fbab0b31130b51.

I followed the same tutorial to set mine up, but had this issue: Upon using invalid api_token or no token at all, I am redirected to the /login route, which in my case is a currently nonexistent route.

As instructed by the guide, I already edited my app/Http/Middleware/Authenticate.php file to add the || $request->wantsJson() condition, but my API routes still redirected to /login route upon detection of invalid api_token.

The solution

What I did was add another condition: || $guard == "api"

And now, my app/Http/Middleware/Authenticate.php file looks like this:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class Authenticate
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string|null  $guard
     * @return mixed
     */
    public function handle($request, Closure $next, $guard = null)
    {
        if (Auth::guard($guard)->guest()) {
            if ($request->ajax() || $request->wantsJson() || $guard == “api”) {
                return response(‘Unauthorized.’, 401);
            } else {
                return redirect()->guest(‘login’);

            }
        }

        return $next($request);
    }
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

<?php

namespace App\Http\Middleware;

use Closure;

use Illuminate\Support\Facades\Auth;

class Authenticate

{

/**

* Handle an incoming request.

*

* @param \Illuminate\Http\Request $request

* @param \Closure $next

* @param string|null $guard

* @return mixed

*/

public function handle($request, Closure $next, $guard = null)

{

if (Auth::guard($guard)->guest()) {

if ($request->ajax() || $request->wantsJson() || $guard == “api”) {

return response(‘Unauthorized.’, 401);

} else {

return redirect()->guest(‘login’);

}

return $next($request);

}

July 21, 2016

Laravel 5 RESTful API with Basic Auth: PHPUnit Testing

I’ve been using PHPUnit to test my RESTful API. PHPUnit is ready to use in Laravel.

In my Laravel-based RESTful API, I have an endpoint /api/users which returns JSON data when you send a GET request. The API will only return such data if the client sends the corrent username and password (Basic Authentication). The JSON data looks like this:

{“success”:true,”users”:[{“id”:1,”name”:”default”,”email”:”def@def.def”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:2,”name”:”Eddard Stark”,”email”:”winter@westeros.org”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:3,”name”:”Jon Snow”,”email”:”lorcommander@nightswatch.org”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:4,”name”:”Sansa Stark”,”email”:”wholetthedogsout@winterfell.com”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:5,”name”:”Tyrion Lanniter”,”email”:”ilikedragons@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:6,”name”:”Lyanna Mormont”,”email”:”lyanna@bearisland.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:7,”name”:”Davos Seaworth”,”email”:”seaworth@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:8,”name”:”Daenerys Targaryen”,”email”:”queen@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:9,”name”:”Cersei Lannister”,”email”:”longmayshereign@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:10,”name”:”Gregor Clegane”,”email”:”hound@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″}],”status_code”:200}

1

{“success”:true,“users”:[{“id”:1,“name”:“default”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:2,“name”:“Eddard Stark”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:3,“name”:“Jon Snow”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:4,“name”:“Sansa Stark”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:5,“name”:“Tyrion Lanniter”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:6,“name”:“Lyanna Mormont”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:7,“name”:“Davos Seaworth”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:8,“name”:“Daenerys Targaryen”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:9,“name”:“Cersei Lannister”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:10,“name”:“Gregor Clegane”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”}],“status_code”:200}

I’m gonna show you how to create a PHPUnit test for this kind of JSON API data in Laravel 5.

To create a test case, use this command:

 php artisan make:test ApiUsersTest

1	php artisan make:test ApiUsersTest

This will create a new test case named ApiUsersTest.php in your directory /tests

Paste the following code in it.

<?php

use Illuminate\Foundation\Testing\WithoutMiddleware;
use Illuminate\Foundation\Testing\DatabaseMigrations;
use Illuminate\Foundation\Testing\DatabaseTransactions;

class ApiUsersTest extends TestCase
{
    use DatabaseTransactions; 

    public function testGetAllUsersNoAuth()
    {
		$content = $this->call(‘GET’, ‘/api/users’)->getContent();
		$this->assertEquals($content, “Invalid credentials.”);
    }

    public function testGetAllUsersWithBasicAuth()
    {
	    $content = $this->call(‘GET’, ‘/api/users’,[],[], [], [
            “HTTP_Authorization” => “Basic ” . base64_encode(“username” . “:” . “password”),
            “PHP_AUTH_USER” => “username”, // must add this header since PHP won’t set it correctly
            “PHP_AUTH_PW” => “password” // must add this header since PHP won’t set it correctly as well
        ])->getContent();

		$json_content = json_decode($content);

        if(!empty($json_content->success)){
        	$this->assertTrue($json_content->success); // this test expects the JSON key “success” to have value of Boolean true
        }
        
	}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

<?php

use Illuminate\Foundation\Testing\WithoutMiddleware;

use Illuminate\Foundation\Testing\DatabaseMigrations;

use Illuminate\Foundation\Testing\DatabaseTransactions;

class ApiUsersTest extends TestCase

{

use DatabaseTransactions;

public function testGetAllUsersNoAuth()

{

$content = $this->call(‘GET’, ‘/api/users’)->getContent();

$this->assertEquals($content, “Invalid credentials.”);

}

public function testGetAllUsersWithBasicAuth()

{

$content = $this->call(‘GET’, ‘/api/users’,[],[], [], [

“HTTP_Authorization” => “Basic “ . base64_encode(“username” . “:” . “password”),

“PHP_AUTH_USER” => “username”, // must add this header since PHP won’t set it correctly

“PHP_AUTH_PW” => “password” // must add this header since PHP won’t set it correctly as well

])->getContent();

$json_content = json_decode($content);

if(!empty($json_content->success)){

$this->assertTrue($json_content->success); // this test expects the JSON key “success” to have value of Boolean true

}

Edit the test case as needed.

July 9, 2016

Google Maps get coordinates on click or drag and drop

With this tutorial you’ll see how we can place a Google map with search box on your web page, and then get coordinates (i.e. latitude and longitude) based on where you click or where you drag and drop the marker into. The JavaScript API of Google Maps will help us achieve this.

This kind of map will be useful if you want to save coordinates from a Google map into your database. For example, if you’d like to save coordinates of a user-defined location, you can incorporate this map into your registration process — ask your users to point the marker to their location by clicking on the map or by dragging then dropping the marker.

There will be two types of icons in this map. First, a red default marker. Wherever you move it, we’ll get the coordinates that it points to. Second, white square markers which will appear to point to the location you searched for using the search box.

Map Demo

Try the map below — this is more or less how our map will look like later at the end of this tutorial. 🙂 Please read on and soon I’ll share the codes with you.

Get coordinates from Google Map

Latitude: Longitude:

Click on any point or drag the marker to get coordinates.

This tutorial will cover the following:

Google map on a web page
Search box for map
Get map coordinates on click
Get map coordinates on drag and drop of the marker

And you will need these:

Familiarity with HTML and JavaScript
Internet connection
Google account
Development environment (I used XAMPP on Windows 7 for this)
Code editor (I use Sublime Text)

(more…)

October 12, 2015

Facebook App Development tips, guides, and possible solution to issues

In July 2013, I began learning about developing apps that run in Facebook. For a web developer especially one who works in a marketing agency, learning about Facebook app development is important nowadays because numerous amounts of campaigns are ran on Facebook.

At first Facebook app development confused me, but after some exposure to it and some help from colleagues who have been doing it for years, I got the feel of it.

Following are some blog entries on my Code Playground that are related to Facebook app development. (more…)

September 16, 2013

Tag: API