Cors information is not at the response header's when i throw an exception about slim-api-skeleton

[tuupola]

In case of 404 instead of you can call the handler manually. Instead of throwing an exception which will stop executing the middleware stack.

throw new NotFoundException("Not found", 404);

Instead you can call the not found handler manually. This way CORS headers will stay intact with the 404 response.

$handler = $this->get("notFoundHandler");
return $handler($request, $response);

[tuupola]

When you throw an Exception rest of the middleware stack will not be executed. Instead of throwing exception from your custom authenticator you can handle the error with the middlewares error handler.

$container["HttpBasicAuthentication"] = function ($container) {
    return new HttpBasicAuthentication([
        "path" => "/token",
        "authenticator" => new YourCustomAuthenticator,
        "error" => function ($request, $response, $arguments) {
            $problem = new ApiProblem($arguments["message"], "about:blank");
            $problem->setStatus(401);
            return $response
                ->withHeader("Content-type", "application/problem+json")
                ->write($problem->asJson(true));
        },
        "users" => [
            "test" => "test"
        ]
    ]);
};

$ curl "https://192.168.50.2/token" --request POST --include --insecure \
  --header "Content-Type: application/json" --data '["todo.all"]' \
  --header "Origin: http://example.com/" --user no:such

HTTP/1.1 401 Unauthorized
Date: Sat, 29 Apr 2017 04:09:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.6.30
WWW-Authenticate: Basic realm="Protected"
Access-Control-Allow-Origin: http://example.com
Access-Control-Allow-Credentials: true
Vary: Origin
Access-Control-Expose-Headers: Authorization
Access-Control-Expose-Headers: Etag
Content-Length: 86
Connection: close
Content-Type: application/problem+json

{
    "title": "Authentication failed",
    "type": "about:blank",
    "status": 401
}

[pdrappo]

Ok, first, thanks to replay, here you are using a middleware, but in the case i wrote, i used the route "/token" to check credentials passed in the body of a http request, the HttpBasicAuthentication middleware is not enabled in my project. Based in the route /todo that you wrote, in line 33 you throw an Exception.. I asume this going to respond a status code with message, and in his header he will return CORS information, but this is not happen.

$app->get("/auth/login", function ($request, $response, $arguments) {

       //Obtengo las credenciales del cuerpo del mensaje
       $credentials = $request->getParsedBody();
       $mapper = $this->spot->mapper("App\Entities\Auth\User");
       // Selecciono el usuario
       $result = $mapper->where([
           'username' => $credentials['username'],
           'password' => md5($credentials['password'])
           ])->with('perms')->first();

       if(!$result){
         $data = array("status" => "error", "msg" => "");
         if(
           $mapper->where(['username' => $credentials['username']])
                   ->first()){
                     $alert = ["type" => "danger", "message" => "La contraseña es incorrecta"];
                   }else{
                     $alert = ["type" => "danger", "message" => "El usuario ingresado no existe."];
                   }

         $this->logger->info($alert, $credentials);
         throw new NotFoundException($msg, 404);
       }

       //Success result query

       //....

       $data["status"] = "ok";
       $data["token"] = $token;

       return $response->withStatus(201)
           ->withHeader("Content-Type", "application/json")
           ->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));

});

In the case above, if the query is true (User exists) i make de token and respond, if query result is false i throw an Exception wich has no CORS information. Instead of this i have to do:

$app->get("/auth/login", function ($request, $response, $arguments) {
        //.....
       //Obtengo las credenciales del cuerpo del mensaje
       $credentials = $request->getParsedBody();
       $mapper = $this->spot->mapper("App\Entities\Auth\User");
       // Selecciono el usuario
       $result = $mapper->where([
           'username' => $credentials['username'],
           'password' => md5($credentials['password'])
           ])->with('perms')->first();

       if(!$result){

         //User doesn't exists
         return $response->withStatus(401)
           ->withHeader("Content-Type", "application/json")
           ->write(json_encode($alert, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));

       }

       //Success result query
       return $response->withStatus(201)
           ->withHeader("Content-Type", "application/json")
           ->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));

});

I'm using AngularJS to consume this api, so if i receive a cross domain request with not CORS it will not work. That is the reason why i wrote here.
Thanks

[tuupola]

You might want to check #15 which is now merged. I removed all internal exceptions due to same problems you described here.

For example:

throw new ForbiddenException("Token not allowed to list todos", 403);

is now:

return new ForbiddenResponse("Token not allowed to list todos", 403);