I use ApiKey authentication for a vuejs frontend application, haveing CakePHP at the backend. At first the user give his email and password to identify himself and in the response he gets his ApiKey, and all later requests happens by ApiKey authentication - currently as a query string parameter.

I want to use it as a header instead of the query string.

The problem is the following. When I send an ajax request to the backend it sends OPTIONS request without the ApiKey header. It is because by CORS policy it will send a preflight requests. Perhaps because the ApiKey header is missing the backend sends back a 302 response instead of the actual content.

So what I would need is allowing OPTIONS requests to the application without the ApiKey.

CakeDC/Users is breaking with the recently released CakePHP 3.6.12.

Notice (1024): Undefined property: PagesController::$Cookie in /cakesandbox/vendor/cakedc/auth/src/Auth/RememberMeAuthenticate.php on line 42 [CORE/src/Controller/Controller.php, line 387]

I'm using CakeDC/Users and this repo is a dependency.

Replace Zend\Diactoros\Uri imports by Laminas\Diactoros\Uri to fix the following issues :

https://github.com/CakeDC/auth/issues/69 https://github.com/CakeDC/users/issues/997

Since CakePHP is using Laminas namespaces I don't see any drawbacks to use it as well in the plugin

https://github.com/cakephp/cakephp/blob/4.x/composer.json#L31

Moreover the Zend Diactoros repository is abandoned since the end of 2019.

This is my first contribution, let me know if I've made something wrong.

I tried to create a permissions.php file in the plugins/SharpAgent/config directory, however it wasn't loaded...

How can I add in my plugin bootstrap the following?

return [
    'Users.SimpleRbac.permissions' => [
        [
            'role' => ['user', 'member', 'admin'],
            'plugin' => 'SharpAgent',
            'controller' => 'Agent',
            'action' => '*',
            'allowed' => true,
        ]
]];

Hello, I'm struggling with this issue on production just after deployment.

2022-05-20 16:40:25 error: [Error] Class "Zend\Diactoros\Uri" not found in /app/vendor/cakedc/auth/src/Traits/IsAuthorizedTrait.php on line 74
Stack Trace:
- /app/vendor/cakedc/auth/src/Traits/IsAuthorizedTrait.php:61
- /app/vendor/cakedc/auth/src/Traits/IsAuthorizedTrait.php:37
- /app/vendor/cakedc/users/src/View/Helper/AuthLinkHelper.php:49
- /app/templates/element/global/navbar.php:27
- /app/vendor/cakephp/cakephp/src/View/View.php:1181
- /app/vendor/cakephp/cakephp/src/View/View.php:1138
- /app/vendor/cakephp/cakephp/src/View/View.php:1673
- /app/vendor/cakephp/cakephp/src/View/View.php:660
- /app/templates/layout/default.php:10
- /app/vendor/cakephp/cakephp/src/View/View.php:1181
- /app/vendor/cakephp/cakephp/src/View/View.php:1138
- /app/vendor/cakephp/cakephp/src/View/View.php:821
- /app/vendor/cakephp/cakephp/src/View/View.php:780
- /app/vendor/cakephp/cakephp/src/Controller/Controller.php:764
- /app/src/Controller/PagesController.php:65
- /app/vendor/cakephp/cakephp/src/Controller/Controller.php:539
- /app/vendor/cakephp/cakephp/src/Controller/ControllerFactory.php:140
- /app/vendor/cakephp/cakephp/src/Controller/ControllerFactory.php:115
- /app/vendor/cakephp/cakephp/src/Http/BaseApplication.php:317
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:77
- /app/vendor/cakephp/authorization/src/Middleware/RequestAuthorizationMiddleware.php:102
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/authorization/src/Middleware/AuthorizationMiddleware.php:129
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/authentication/src/Middleware/AuthenticationMiddleware.php:124
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php:174
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Http/Middleware/BodyParserMiddleware.php:157
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Routing/Middleware/RoutingMiddleware.php:161
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Routing/Middleware/AssetMiddleware.php:68
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Error/Middleware/ErrorHandlerMiddleware.php:126
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /app/vendor/cakephp/cakephp/src/Http/Runner.php:58
- /app/vendor/cakephp/cakephp/src/Http/Server.php:90
- /app/webroot/index.php:40

Runtime PHP 8.1.6

Composer.lock deps :

            "name": "cakedc/users",
            "version": "11.1.0",
            
            "name": "cakedc/auth",
            "version": "7.0.1",

I don't understand what's wrong and why I have no problem in dev env.

Tell me if you want more informations for trying to reproduce this strange behaviour

Hi,

In the source code there a parameter to allow an empty field from request pass as valid, but that parameter are never read.

I tried write a permission rule as below, to allow anyone access any action without a prefix:

[
        'role' => '*',
        'prefix' => null,
        'extension' => '*',
        'plugin' => '*',
        'controller' => '*',
        'action' => '*',
]

But the method _matchOrAsterisk fail because in_array(null, []) === false.

Hello :wave:

I get random Call to undefined method ArrayObject::toArray()

2021-09-03 16:46:34 Error: [Error] Call to undefined method ArrayObject::toArray() in /var/www/html/vendor/cakedc/auth/src/Authentication/AuthenticationService.php on line 117
Stack Trace:
- /var/www/html/vendor/cakephp/authentication/src/Middleware/AuthenticationMiddleware.php:105
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /var/www/html/vendor/cakephp/cakephp/src/Http/Middleware/BodyParserMiddleware.php:159
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:77
- /var/www/html/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php:169
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:58
- /var/www/html/vendor/cakephp/cakephp/src/Routing/Middleware/RoutingMiddleware.php:167
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /var/www/html/vendor/cakephp/cakephp/src/Routing/Middleware/AssetMiddleware.php:68
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:73
- /var/www/html/vendor/cakephp/cakephp/src/Http/Runner.php:58
- /var/www/html/vendor/cakephp/cakephp/src/Http/Server.php:90
- /var/www/html/webroot/index.php:40

I am not able to reproduce this always and I do not understand why this happen sometimes and not everytimes.

When the error occurs, the app is blocked for all pages for the current logged in user.

Clearing CakePHP cache with bin/cake cache clear_all or clearing the cookies for the app (thus destroying the session) solves the problem until next time.

cakedc/auth version is 6.1.0  ; CakePHP version is 4.2.6

Have you any idea ?

Example usage in users.php in the Users plugin:

'Auth' => [
	'RbacPolicy' => [
		'adapter' => [
			'autoload_config' => [
				'MyPlugin.permissions',
				'MyOtherPlugin.permissions',
				'permissions',
			],
		],
	],
],

Since the array is optional, it should not break existing implementations

Updating the documentation for ApiKeyAuthenticate to detail about how underscores in headers are dropped by Ngnix and Apache 2.4.x

Ngnix https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/?highlight=disappearing%20http%20headers#missing-disappearing-http-headers If you do not explicitly set underscores_in_headers on;, NGINX will silently drop HTTP headers with underscores (which are perfectly valid according to the HTTP standard). This is done in order to prevent ambiguities when mapping headers to CGI variables as both dashes and underscores are mapped to underscores during that process.

Apache https://httpd.apache.org/docs/trunk/new_features_2_4.html Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped. Environment Variables in Apache has some pointers on how to work around broken legacy clients which require such headers. (This affects all modules which use these environment variables.)

Currently SimpleRbacAuthorize can only be used as an authorize adapter for the AuthComponent. It would be nice if it was converted into a standalone lib which could then be used through a middleware.

I have a plugin named Ord. When using 'plugin' => 'Ord' in my permissions array, the _matchPermission() method evaluates is_callable('Ord') as true and attempts to call_user_func().

ord() is a built-in PHP function so is_callable() returns true. Additional checks on $value should be performed: if(!is_string($value) and is_callable($value))

This PR provides compatibility with the current Cake5 beta-1

This also of course required the following base adjustments in the composer.json

    "require": {
        "php": ">=8.1.0",
        "cakephp/cakephp": "5.x-dev"
    },
    "require-dev": {
        "cakephp/authorization": "3.x-dev",
        "cakephp/cakephp-codesniffer": "^5.0",
        "cakephp/authentication": "3.x-dev",
    }

This also updates PHPStan and Psalm to the latest versions as well as PHPUnit to 9.5

I first tried to make CakeDC/Users Cake5 compatible but saw, that this plugin needs to be updated beforehand.

Since the current main branch is 6.next-cake4 I first did all the adjustments based on that one. Unfortunately I realized pretty late that 8.next-cake4 was present as well.

Therefore I just merged 8.next into mine and fixed all the merge conflicts afterwards.

I have just updated from 6.1.0 to 6.2.0 and I received this errors after login

Warning (2): class_implements(): object or string expected [ROOT/vendor/cakedc/auth/src/Authentication/Webauthn2fAuthenticationCheckerFactory.php, line 32]

I had to revert back to 6.1 to make my app work again

Thank you

Rudy