使用Slim 3在app运行之前验证usertoken

Question

I am using Slim Framework 3 to make a small internal API to get fetch facebook data. There is about 30 specific users which have access to the API.

I want to authenticate a user by a user token send from the website, and that token is to be checked before the app is run.

The token on the user is set in the DB and when the user is requesting the API a token is send with a GET and if there is a match on the DB and the GET token, the user should be granted access to the API, otherwise the user should be forbidden to access.

I am using this to get facebook data:

$app->get('/fbdata/campaign/{campaign}/bankarea/{bankarea}/from/{from}/to/{to}/utoken/{utoken}', function(Request $request, Response $response) {

    $bd = new BankAppData();
    $getFb = new GetFacebookData();

    $bankarea = $request->getAttribute('bankarea');
    $campaign = $request->getAttribute('campaign');

    $appid = $bd->BankData($bankarea)->appid;
    $appsecret = $bd->BankData($bankarea)->appsecret;
    $fbtoken = $bd->BankData($bankarea)->fbtoken;

    $dateFrom = $request->getAttribute('from');
    $dateTo = $request->getAttribute('to');

    $getFb->FetchData($appid, $appsecret, $fbtoken, $campaign, $bankarea, "act_XXXX", $dateFrom, $dateTo);


});

This works just fine, but I want to use a AuthenticationHandler class for checking the utoken before the above is run.

I am adding it by using $app->add(new SNDB\AuthenticationHandler()); but I am unsure on how I can get the utoken from the URL in my AuthenticationHandler class.

Basically I want to do something like

function Authenticate() {

   if($dbToken != $utoken) {
      //No access - app will just stop doing anything else
   } else {
     //You have access - just continue what you was trying to do
   }

}

Answer 1

You should take a look at the middleware concept from slim3.

Basically there are 2 options how to add middleware:

1. per anonymous function

   $app->add(function ($request, $response, $next) {
       $response->getBody()->write('BEFORE');
       $response = $next($request, $response);
       $response->getBody()->write('AFTER');
   
       return $response;
   });
   

2. per invokable class

   class ExampleMiddleware
   {
       public function __invoke($request, $response, $next)
       {
           $response->getBody()->write('BEFORE');
           $response = $next($request, $response);
           $response->getBody()->write('AFTER');
   
           return $response;
       }
   }
   $app->add(new ExampleMiddleware);
   

There you have the PSR-7 request and can get your utoken from the url.