Symfony2 Oauth2 Server with authorization code grant, Symfony2 APIRest and Angular JS client

2
votes

What I have:

-API Rest in Symfony2 using friendsofsymfony/rest-bundle exposing some resources.

-Oauth2 server in Symfony2 using FOSOAuthServerBundle.

-Client in Angular.js doing requests to the API Rest. This client currently gets to login via the authorization code grant (using Hello.js with a custom module), and gets the access token effectively.

I want these API resources secured, so:

-On API Rest app: I implemented the AuthenticationEntryPointInterface which I set as the entry_point in security.yml, to return 401 code and application/json content-type on rejected.

-Client intercepts 401 responses and sends the user to the login form.

-Client sends api rest requests with X-Access-Token set on header.

My current issues:

1) I'm not sure whether I should be setting X-Access-Token on client for requests, I understand this is the right way? Or should I leave it all to hello.js api methods?

2) I have no idea how to make the API Rest app "ask" the oauth server "is this token ok? who does it belong to?" Is this already solved in Symfony?

Thanks a lot for any answer or guideline. Feel free to require any further information or code for what I describe.

1
angularjsrestsymfonyoauth-2.0hello.js

1 Answers

0
votes

For anyone else facing a similar issue:

1) As for the client authenticated requests after login, I let hello.js hello(provider).api methods solve it. It sends access_token as a param. I didn't have to set X-Access-Token on the header or any other "hand made" touch.

2) I didn't find an out of the box solution by symfony for this. But this is what I did:

-Configured a before filter for the protected controller (see doc)

-In that method, I made a call to the API held on the OAuthServer (using this bundle)