[13.x] Use the oauth_scopes property of the bearer token on TokenGuard
#1755
Conversation
|
Thanks for submitting a PR! Note that draft PR's are not reviewed. If you would like a review, please mark your pull request as ready for review in the GitHub user interface. Pull requests that are abandoned in draft may be closed due to inactivity. |
AccessToken classouath_scopes property of the access token on TokenGuard and CheckClientCredentials middleware
ouath_scopes property of the access token on TokenGuard and CheckClientCredentials middlewareoauth_scopes property of the bearer token on TokenGuard
|
Is it not possible for the scopes to be manipulated by the user if we are using the scopes present on the request attributes? |
|
@taylorotwell the |
Fixes #382
As discussed here, this PR fixes a long-standing issue #382.
The
TokenGuardauthenticates the user via bearer token and assigns this token to the authenticated user. This will be useful when the developer wants to check if the token has a given scope using thetokenCanmethod on the authenticatedApp\Models\Userinstance:The problem is that the
TokenGuardguard (and alsoCheckClientCredentialsmiddleware) unnecessarily query the DB to find the token's record and retrieve its scopes, but we have already decoded the token and we can simply use theoauth_scopesproperty instead.This PR fixes the issue by separating the logic into new
Passport\AccessTokenclass from thePassport\Tokenmodel, so we don't need to query the DB to find the token. This can be considered as performance optimization and also a security fix!Upgrade Guide
There shouldn't be any breaking change here, the
user()->tokenCan()is the only documented functionality and works like before. Theuser()->token()returnsTransientTokenif the user is authenticated via the cookie just like before, but now returnsPassport\AccessTokeninstance instead ofPassport\Tokeninstance when the user is authenticated via bearer token, but to avoid any breaking change, this class dynamically forwards method calls toPassport\Token.