RequestPathRule passthrough?

[chrisrasco]

Great work on this middleware Mike!

In reviewing it for use in one of my projects, I was curious what the best way to exclude a URI would be (i.e. /user/login). I see there is a "path" option for the RequestPathRule class that is passed in here to specify path groups, but I don't see where you are passing through the "passthrough" option here. (You are sending "passthrough" for RequestMethodRule just above this)

Am I missing something or am I attempting to solve the problem of a "login url" in a different way than you had intended.

[tuupola]

It's not documented yet but this is what I currently use in live code. In short there is /token url which is protected by HTTP Basic Authentication and it returns an JWT Token. The RequestPathRule in this example says authenticate everything / with JwtAuthentication except /token and /hello.

$app->add(new JwtAuthentication([
    "secret" => getenv("JWT_SECRET"),
    "logger" => $app->log,
    "rules" => [
        new RequestPathRule([
            "path" => "/",
            "passthrough" => ["/token", "/hello"]
        ])
    ],
    "callback" => function ($options) use ($app) {
        /* Something */
    }
]));

$app->add(new HttpBasicAuthentication([
    "path" => "/token",
    "users" => [
        "example" => "password"
    ]
]));

Another example how the RequestPathRule works. Authenticate everything under /api except /api/public.

$app->add(new JwtAuthentication([
    "secret" => getenv("JWT_SECRET"),
    "logger" => $app->log,
    "rules" => [
        new RequestPathRule([
            "path" => "/api",
            "passthrough" => ["/api/public"]
        ])
    ],
    "callback" => function ($options) use ($app) {
        /* Something */
    }
]));

Rules are a stack of callables, so you ca use anonymous functions too. If any of the rules return boolean false middleware will assume authentication is not needed and the url is public.

The middleware itself is still work in progress, but I do use it in production already. That said some things might change.

[tuupola]

Did this answer your question?

[chrisrasco]

Yes it did, thanks! I'm prepping to role this out as a core part of many different apps I'm working on at the moment.

[Gbetus]

Gracias, esto estaba buscando. Thanks

[HughxDev]

Please add this answer to the docs!

[tuupola]

Yep. It is still in the todo list. Will update docs shortly.