在 symfony 4 和 Api 平台上添加一个注销动作,并在 React Native 上使用这个动作来销毁 JWT 生成的令牌

哈立德·布索法拉

我使用带有 Api 平台和 jwt 包的 symfony 4 来管理带有令牌的用户身份验证。我想添加一个注销操作以从前端应用程序注销用户并销毁令牌并重定向到登录屏幕(前端带有 React Native)。我在 security.yml 中的配置:

security:
    encoders:
        App\Entity\AppUser:
            algorithm: auto
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\AppUser
                property: email
        # used to reload user from session & other features (e.g. switch_user)
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            stateless: true
            anonymous: true
            provider: app_user_provider
            json_login:
                check_path: /authentication_token
                username_path: email
                password_path: password
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
            guard:
                authenticators:
                    - lexik_jwt_authentication.jwt_token_authenticator
            logout:
                path: app_logout
        refresh:
            pattern:  ^/token/refresh
            stateless: true
            anonymous: true

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#firewalls-authentication

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/token/refresh, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/docs, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/generate_token, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY }

我创建了一个 securityController.php 并添加了这样的注销操作:

<?php


namespace App\Controller;


use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Routing\Annotation\Route;

class SecurityController extends AbstractController
{
    /**
     * @Route("/logout", name="app_logout", methods={"GET"})
     */
    public function logout()
    {
        throw new \Exception('should not be reached');
    }
}

我在我的前端应用程序中创建了一个函数,如下所示:

logoutAndDestroyToken() {
    axios.get(API.partage_mandats_local + '/logout', { headers: { 'Authorization': 'Bearer ' + this.props.token } })
      .then((response) => {
        console.log(response.data)
        this.props.navigation.navigate('Dashboard')
      })
      .catch((error) => {
        console.log('Error' + error)
      })
  }

但我收到了一个奇怪的对象作为回应。axios 函数的响应是:

{
    "@context": "/contexts/Entrypoint",
    "@id": "/",
    "@type": "Entrypoint",
    "mandateRequest": "/mandate_requests",
    "contactProject": "/contact_projects",
    "contactRequest": "/contact_requests",
    "tradeOperationType": "/trade_operation_types",
    "requestStatus": "/request_statuses",
    "city": "/cities",
    "contactType": "/contact_types",
    "contact": "/contacts",
    "contactRequestCommission": "/contact_request_commissions",
    "appUser": "/app_users",
    "mandate": "/mandates"
}

我需要的是注销并销毁令牌。请问有什么建议吗?

玛丽娜

您可以简单地删除您存储在客户端(EI 浏览器、本地存储)的令牌。为了更安全,您应该从服务器端使令牌无效,此链接对于理解场景很有用。

本文收集自互联网,转载请注明来源。

如有侵权,请联系[email protected] 删除。

编辑于
0

我来说两句

0条评论
登录后参与评论

相关文章

Related 相关文章

热门标签

归档