{"action":"created","issue":{"url":"https://api.github.com/repos/sahat/satellizer/issues/462","labels_url":"https://api.github.com/repos/sahat/satellizer/issues/462/labels{/name}","comments_url":"https://api.github.com/repos/sahat/satellizer/issues/462/comments","events_url":"https://api.github.com/repos/sahat/satellizer/issues/462/events","html_url":"https://github.com/sahat/satellizer/issues/462","id":90047161,"number":462,"title":"[PHP] Laravel improvements","user":{"login":"barryvdh","id":973269,"avatar_url":"https://avatars.githubusercontent.com/u/973269?v=3","gravatar_id":"","url":"https://api.github.com/users/barryvdh","html_url":"https://github.com/barryvdh","followers_url":"https://api.github.com/users/barryvdh/followers","following_url":"https://api.github.com/users/barryvdh/following{/other_user}","gists_url":"https://api.github.com/users/barryvdh/gists{/gist_id}","starred_url":"https://api.github.com/users/barryvdh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/barryvdh/subscriptions","organizations_url":"https://api.github.com/users/barryvdh/orgs","repos_url":"https://api.github.com/users/barryvdh/repos","events_url":"https://api.github.com/users/barryvdh/events{/privacy}","received_events_url":"https://api.github.com/users/barryvdh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-22T08:54:42Z","updated_at":"2015-06-25T08:00:29Z","closed_at":null,"body":"Thanks for this project! Here are some improvements for Laravel. If you want I can PR them:\r\n\r\n- Instead of using a new Authenticate method and store the user in the request, we could also log the user in directly: `$this->auth->onceUsingId($payload['sub']);` \r\nIf you create a new middleware (eg. `jwt`) you can use both the `jwt` middleware and regular `auth` middleware. In the controllers, you can just do `Auth::check()` and `Auth::user()`.\r\n\r\n- Instead of using the custom OAuth for all providers, we can use https://github.com/laravel/socialite which handles Bitbucket, Github, Google, Twitter, LinkedIn and Facebook by default + extra via http://socialiteproviders.github.io/\r\n\r\nFor OAuth2, it's something like this for every provider:\r\n\r\n    public function provider(Request $request, $name)\r\n    {\r\n        if ($request->has('redirectUri')) {\r\n            config()->set(\"services.{$name}.redirect\", $request->get('redirectUri'));\r\n        }        \r\n\r\n        $provider = \\Socialite::driver($name);\r\n        $provider->stateless();\r\n\r\n        try {\r\n            /** @var AbstractUser $profile */\r\n            $profile = $provider->user();\r\n        } catch (ClientException $e) {\r\n            return response()->json(['message' => (string) $e->getResponse()->getBody()], 500);\r\n        }\r\n        \r\n        $user->$name = $profile->getId();\r\n        $user->name = $profile->getName();\r\n        $user->avatar = $profile->getAvatar();\r\n        $user->email = $profile->getEmail();\r\n        $user->save();\r\n        \r\n        return response()->json(['token' => $this->createToken($user)]);\r\n    }\r\n\r\nOAuth1 is a bit different, but can get the same Profile information:\r\n\r\n\r\n        $provider = \\Socialite::driver($name);\r\n        \r\n        // Part 1 of 2: Initial request from Satellizer.\r\n        if ( ! $request->input('oauth_token') || ! $request->input('oauth_verifier')) {\r\n            // Redirect to fill the session (without actually redirecting)\r\n            $provider->redirect();\r\n\r\n            /** @var TemporaryCredentials $temp */\r\n            $credentials = $request->getSession()->get('oauth.temp');\r\n\r\n            return response()->json(['oauth_token' => $credentials->getIdentifier()]);\r\n        }\r\n        // Part 2 of 2: Second request after Authorize app is clicked.\r\n        else\r\n        {\r\n            $credentials = new TemporaryCredentials();\r\n            $credentials->setIdentifier($request->input('oauth_token'));\r\n            $request->getSession()->set('oauth.temp', $credentials);\r\n\r\n            try {\r\n                /** @var AbstractUser $profile */\r\n                $profile = $provider->user();\r\n            } catch (ClientException $e) {\r\n                return response()->json(['message' => (string) $e->getResponse()->getBody()], 500);\r\n            }\r\n        }\r\n\r\nThis will make it a lot simpler to add more drivers :)\r\n\r\nCommon pitfalls:\r\n - CORS is required for cross-domain: https://github.com/barryvdh/laravel-cors\r\n- Sometimes Authorization header is removed? Add to .htaccess: `RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]`\r\n"},"comment":{"url":"https://api.github.com/repos/sahat/satellizer/issues/comments/115154248","html_url":"https://github.com/sahat/satellizer/issues/462#issuecomment-115154248","issue_url":"https://api.github.com/repos/sahat/satellizer/issues/462","id":115154248,"user":{"login":"sahat","id":544954,"avatar_url":"https://avatars.githubusercontent.com/u/544954?v=3","gravatar_id":"","url":"https://api.github.com/users/sahat","html_url":"https://github.com/sahat","followers_url":"https://api.github.com/users/sahat/followers","following_url":"https://api.github.com/users/sahat/following{/other_user}","gists_url":"https://api.github.com/users/sahat/gists{/gist_id}","starred_url":"https://api.github.com/users/sahat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sahat/subscriptions","organizations_url":"https://api.github.com/users/sahat/orgs","repos_url":"https://api.github.com/users/sahat/repos","events_url":"https://api.github.com/users/sahat/events{/privacy}","received_events_url":"https://api.github.com/users/sahat/received_events","type":"User","site_admin":false},"created_at":"2015-06-25T08:00:28Z","updated_at":"2015-06-25T08:00:28Z","body":":+1: for the first suggestion. I am not too familiar with Laravel's `Authenticate` middleware, so I did what I could in order to get the User object after successful authentication.\r\n\r\nI don't like the idea of using a 3rd-party library to abstract away all implementation details of oauth providers in this specific case. The only reason I was able to write so many backend examples, when I am only comfortable with Node.js, is because the flow is exactly the same, regardless of which language or server-side framework you are using. Another advantage is that it could be used as a learning resource, because it isn't a black box like passport.js, omniauth, socialite.\r\n\r\nThere used to be a `.htaccess` that fixed the CORS problem, but I guess it was nuked during Laravel 4 to Laravel 5 conversion. I'll see if I can revert it back."}}