yii2框架-restful的请求参数token验证(二十三)

在控制器中重写初始化函数,设置enableSession = false

public function init()
{
    parent::init();
    Yii::$app->user->enableSession = false;

（2）重写behaviors函数，配置authenticator，引入使用的认证方式。

yiifiltersauthQueryParamAuth;
public function behaviors()
{
    $behaviors = parent::behaviors();
    $behaviors["authenticator"] = [
        "class" => QueryParamAuth::className(),
    ];
    return $behaviors;
}

<?php
namespace apimodels;
use Yii;
use yiiaseNotSupportedException;
use yiiehaviorsTimestampBehavior;
use yiidbActiveRecord;
use yiiwebIdentityInterface;

class User extends ActiveRecord implements IdentityInterface {
	 /**
     * @inheritdoc
     */
    public static function tableName()
    {
        return "users";
    }
    /**
     * @inheritdoc
     */
    public static function findIdentity($id)
    {
        return static::findOne(["id" => $id, "status" => self::STATUS_ACTIVE]);
    }

    /**
     * @inheritdoc
     */
    public static function findIdentityByAccessToken($token, $type = null)
    {
        return static::findOne(["access_token" => $token]);
    }

    //这个就是我们进行yiifiltersauthQueryParamAuth调用认证的函数，下面会说到。
    public function loginByAccessToken($accessToken, $type) {
    	//查询数据库中有没有存在这个token
        return static::findIdentityByAccessToken($token, $type);
    }

    /**
     * Finds user by username
     *
     * @param string $username
     * @return static|null
     */
    public static function findByUsername($username)
    {
        return static::findOne(["username" => $username, "status" => self::STATUS_ACTIVE]);
    }


    /**
     * @inheritdoc
     */
    public function getId()
    {
        return $this->getPrimaryKey();
    }

    /**
     * @inheritdoc
     */
    public function getAuthKey()
    {
        return $this->auth_key;
    }

    /**
     * @inheritdoc
     */
    public function validateAuthKey($authKey)
    {
        return $this->getAuthKey() === $authKey;
    }
}

<?php
/**
 * @link http://www.yiiframework.com/
 * @copyright Copyright (c) 2008 Yii Software LLC
 * @license http://www.yiiframework.com/license/
 */

namespace yiifiltersauth;

/**
 * QueryParamAuth is an action filter that supports the authentication based on the access token passed through a query parameter.
 *
 * @author Qiang Xue <qiang.xue@gmail.com>
 * @since 2.0
 */
class QueryParamAuth extends AuthMethod
{
    /**
     * @var string the parameter name for passing the access token
     */
    public $tokenParam = "access-token";


    /**
     * @inheritdoc
     */
    public function authenticate($user, $request, $response)
    {
        $accessToken = $request->get($this->tokenParam);
        if (is_string($accessToken)) {
            $identity = $user->loginByAccessToken($accessToken, get_class($this));
            if ($identity !== null) {
                return $identity;
            }
        }
        if ($accessToken !== null) {
            $this->handleFailure($response);
        }

        return null;
    }
}

public function behaviors() {
        $behaviors = parent::behaviors();
        $behaviors["authenticator"] = [
            "class" => QueryParamAuth::className(),
            "tokenParam" => "token"  //例如改为‘token’
        ];
        return $behaviors;
}

public function beforeAction($action)
    {
        $response = $this->response ? : Yii::$app->getResponse();

        try {
            $identity = $this->authenticate(
                $this->user ? : Yii::$app->getUser(),
                $this->request ? : Yii::$app->getRequest(),
                $response
            );
        } catch (UnauthorizedHttpException $e) {
            if ($this->isOptional($action)) {
                return true;
            }

            throw $e;
        }

        if ($identity !== null || $this->isOptional($action)) {
            return true;
        } else {
            $this->challenge($response);
            $this->handleFailure($response);
            return false;
        }
    }

所以我们执行yiifiltersauthAuthMethodQueryParamAuth时，也就是执行beforeAction($action)函数，这个函数调用$this->authenticate()这个函数执行，也就是进行操作前的认证。

友情推荐

本人已开源基于swoole扩展实现的轻量级框架

https://github.com/bingcool/swoolefy