php - SLIM 框架路由身份验证 v2 与 v3

Question

我有一个使用 Slim v2 构建的 API，我保护某些传递中间件函数“authenticate”的路由:

    /**
     * List marca novos
     * method GET
     * url /novos/marca/:idmarca
     */
    $app->get('/novos/marca/:idmarca', 'authenticate', function($idmarca) {
        $response = array();
        $db = new DbHandler('dbnovos');


        // fetching marca
        $marca = $db->getMarcaNovos($idmarca);

        $response["error"] = false;
        $response["marca"] = array();

        array_walk_recursive($marca, function(&$val) {
            $val = utf8_encode((string)$val);
        });

        array_push($response["marca"], $marca);

        echoRespnse(200, $response, "marcaoutput");
    })->via('GET', 'POST');

验证函数检查是否发送了 header 授权值 (user_api_key) 并将其与数据库进行检查。

我正在尝试使用 followwing 路由在 Slim v3 API 中获得相同的功能:

    /**
     * List marca novos
     * method GET
     * url /novos/marca/:idmarca
     */
    $app->get('/novos/marca/{idmarca}', function ($request, $response, $args) {

    $output = array();
    $db = new DbHandler('mysql-localhost');
    $marca = $db->getMarcaNovos($args['idmarca']);

    if ($marca != NULL) {
        $i = 0;
        foreach($marca as $m) {
            $output[$i]["id"] = $m['id'];
            $output[$i]["nome"] = utf8_encode($m['nome']);
            $i++;
        }

    } else {
        // unknown error occurred
        $output['error'] = true;
        $output['message'] = "An error occurred. Please try again";
    }

    // Render marca view
    echoRespnse(200, $response, $output, "marca");
})->add($auth);

这是我的中间件

/**
 * Adding Middle Layer to authenticate every request
 * Checking if the request has valid api key in the 'Authorization' header
 */
$auth = function ($request, $response, $next) {

$headers = $request->getHeaders();
$outcome = array();

// Verifying Authorization Header
if (isset($headers['Authorization'])) {
    $db = new DbHandler('mysql-localhost');

    // get the api key
    $api_key = $headers['Authorization'];
    // validating api key
    if (!$db->isValidApiKey($api_key)) {
        // api key is not present in users table
        $outcome["error"] = true;
        $outcome["message"] = "Access Denied. Invalid Api key";
        echoRespnse(401, $outcome, $output);
    } else {
        global $user_id;
        // get user primary key id
        $user_id = $db->getUserId($api_key);
        $response = $next($request, $response);
        return $response;
    }
} else {
    // api key is missing in header
    $outcome["error"] = true;
    $outcome["message"] = "Api key is missing";
    //echoRespnse(400, $response, $outcome);
    return $response->withStatus(401)->write("Not allowed here - ".$outcome["message"]);
}

};

但我总是收到错误消息:“此处不允许 - Api key 丢失”基本上，测试是否设置了 $headers['Authorization'] 是失败的。什么是 $headers 数组结构或如何获取通过 header 传递的授权值？

Answer 1

如果您发送的不是有效的 HTTP 基本授权 header ，PHP 将无法访问它。您可以通过将以下重写规则添加到您的 .htaccess 文件来解决此问题。

RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]