CakePHP Stateless (Basic) Auth, where to call $this->Auth->login()?

Question

My CakePHP v2.4.X app supports both Basic and Form authentication (Form is for web users, and Basic is for Stateless access from Android App).

AppController.php contains the following $components declaration:

public $components = array(
        'Auth' => array(
                'authenticate' => array(
                        'Basic',
                        'Form',
                ),
        ),
);

From the doc on performing stateless Basic Auth: "In your login function just call $this->Auth->login() without any checks for POST data."

My issue is that if the user logs in using Basic Auth, they never trigger Users/login - so I am unsure where to place the $this->Auth->login() function.

Do I simply place this code in AppController/beforeFilter() and if the current user is not logged in I attempt login every time? ie:

if($this->Auth->loggedIn() == false)
{
    $this->Auth->login();
}

This doesn't seem right to me because if the user is using Form login they'll end up calling $this->Auth->login(); twice [once from AppController/beforeFilter(), and again from UsersController/login()].

Also, when simply loading the login (via GET), the system will attempt to log them in and therefore return an error message.

I am also unsure how to determine if the user did login via Basic (as opposed to Form), and therefore set: "AuthComponent::$sessionKey" to false only when Basic was used.

Any help would be much appreciated.

ADmad ADmad · Accepted Answer · 2014-02-02T18:33:00

The manual section related to basic auth doesn't correspond to what you are saying. Since 2.4 basic/digest auth doesn't need a login action at all. Just including Basic in the array for "authenticate" key for auth config is enough. It will automatically cause cake to check for required credentials when trying to access a protected action and if no credential or invalid credentials are provided appropriate headers are returned to the client.

Using both Basic and Form authenticators together can be problematic. I suggest modifying auth config in beforeFilter to use only either one of them conditionally by using appropriate conditions to check if request is from mobile app or not.

CakePHP Stateless (Basic) Auth, where to call $this->Auth->login()?

1 Answers