Initial pass at implementing Laravel Sanctum for authorization on the API
This commit is contained in:
parent
e313dff674
commit
bd37978a98
13 changed files with 324 additions and 220 deletions
|
@ -2,8 +2,6 @@
|
|||
|
||||
namespace Pterodactyl\Http\Middleware;
|
||||
|
||||
use Closure;
|
||||
use Pterodactyl\Models\ApiKey;
|
||||
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
|
||||
|
||||
class VerifyCsrfToken extends BaseVerifier
|
||||
|
@ -16,31 +14,4 @@ class VerifyCsrfToken extends BaseVerifier
|
|||
* @var string[]
|
||||
*/
|
||||
protected $except = ['remote/*', 'daemon/*'];
|
||||
|
||||
/**
|
||||
* Manually apply CSRF protection to routes depending on the authentication
|
||||
* mechanism being used. If the API request is using an API key that exists
|
||||
* in the database we can safely ignore CSRF protections, since that would be
|
||||
* a manually initiated request by a user or server.
|
||||
*
|
||||
* All other requests should go through the standard CSRF protections that
|
||||
* Laravel affords us. This code will be removed in v2 since we have switched
|
||||
* to using Sanctum for the API endpoints, which handles that for us automatically.
|
||||
*
|
||||
* @param \Illuminate\Http\Request $request
|
||||
*
|
||||
* @return mixed
|
||||
*
|
||||
* @throws \Illuminate\Session\TokenMismatchException
|
||||
*/
|
||||
public function handle($request, Closure $next)
|
||||
{
|
||||
$key = $request->attributes->get('api_key');
|
||||
|
||||
if ($key instanceof ApiKey && $key->exists) {
|
||||
return $next($request);
|
||||
}
|
||||
|
||||
return parent::handle($request, $next);
|
||||
}
|
||||
}
|
||||
|
|
Reference in a new issue