Handling for when Accept header not passed about sanctum

[dillingham]

@narwy had this issue too.. easy fix is to update app/Http/Middlewares/Authenticate.php

protected function redirectTo($request)
{
    if($request->is('api/*')) {
        abort(401, 'Access denied');
    }

    if (! $request->expectsJson()) {
        return route('login');
    }
}

[n10000k]

@driesvints That's correct but if you do a clean install of laravel + require this package then visit the example route without the header you get a 500 error.

[n10000k]

@lloy0076 thats correct but if you don’t have a login page and use laravel as a api only solution for your spa and someone accessed that route from their browsers it defaults to a 500 error. Sentry and other tools love this.

@koenhoeijmakers it’s because the Authenticate class has the expectsJson statement, if not being the redirect to Login. But that shouldn’t be a default option. Passport has this same issue also. But I’m questioning it within Airlock now to see if it’s something we can fix going forward.

There’s obviously a way around it with a big of tweaking and adding a middleware etc but I’m just thinking of those already using it for SPA and could effect those error reporting tools if someone decides they want to access direct.

[lloy0076]

I used a Laravel 6 installation, and setup Airlock.

I go to:

curl --location --request GET 'http://laravel-playground.test/api/user'
--header 'Authorization: Bearer hFiORTL2G9LAFQjn3b4rKadJZ1tFuJPUlkjIAr29rhngJqUbbImmN2FYTDcJrNjdpffpdXKWY1IEnDig '

And get:

{
    "id": 1,
    "name": "David Lloyd",
    "email": "[email protected]",
    "email_verified_at": null,
    "created_at": "2019-08-24 00:28:59",
    "updated_at": "2019-12-28 11:58:54"
}

Which is precisely what I expect...

composer.zip

[lloy0076]

If I remove the authorisation header I get a dump of the Login page (as HTML) which is also what I'd expect.

[koenhoeijmakers]

This is not an Airlock issue, this has something to do with the Authenticate middleware which defaults to a redirect to the login route, you're free to change the default to your needs.

[driesvints]

Passing the accept header is required to let the logincontroller return a json response.

[dillingham]

Wondering if having a middleware add it for api routes makes sense @driesvints 🤔

public function handle($request, Closure $next)
{
    $request->headers->set('accept', 'application/json', true);

    return $next($request);
}

[driesvints]

@dillingham I don't think it's wise to solve this with a middleware. API consumers should pass the correct headers.

[dillingham]

@driesvints yeah you're right :) probably best to just add withHeaders in setUp