CakePHP 3.6: protect inner page with existin login form
I have used this tutorial to create a login screen for my application. But I want to protect with the same login form another inner page. So a user can login and use the application but if he/she wishes to open a specific page in the application he/she has to reenter the password for security reasons. How I can achieve that?
This is my initialize function in AppController.php:
$this->loadComponent('Auth', [
'authenticate' => [
'Form' => [
'fields' => [
'username' => 'email',
'password' => 'password'
]
]
],
'loginAction' => [
'controller' => 'Users',
'action' => 'login'
]
]);
php cakephp login oauth authorization
asked Nov 26 '18 at 7:37
dvn22dvn22
937
add a comment |
I have used this tutorial to create a login screen for my application. But I want to protect with the same login form another inner page. So a user can login and use the application but if he/she wishes to open a specific page in the application he/she has to reenter the password for security reasons. How I can achieve that?
This is my initialize function in AppController.php:
$this->loadComponent('Auth', [
'authenticate' => [
'Form' => [
'fields' => [
'username' => 'email',
'password' => 'password'
]
]
],
'loginAction' => [
'controller' => 'Users',
'action' => 'login'
]
]);
php cakephp login oauth authorization
asked Nov 26 '18 at 7:37
dvn22dvn22
937
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37
add a comment |
I have used this tutorial to create a login screen for my application. But I want to protect with the same login form another inner page. So a user can login and use the application but if he/she wishes to open a specific page in the application he/she has to reenter the password for security reasons. How I can achieve that?
This is my initialize function in AppController.php:
$this->loadComponent('Auth', [
'authenticate' => [
'Form' => [
'fields' => [
'username' => 'email',
'password' => 'password'
]
]
],
'loginAction' => [
'controller' => 'Users',
'action' => 'login'
]
]);
php cakephp login oauth authorization
asked Nov 26 '18 at 7:37
dvn22dvn22
937
I have used this tutorial to create a login screen for my application. But I want to protect with the same login form another inner page. So a user can login and use the application but if he/she wishes to open a specific page in the application he/she has to reenter the password for security reasons. How I can achieve that?
This is my initialize function in AppController.php:
$this->loadComponent('Auth', [
'authenticate' => [
'Form' => [
'fields' => [
'username' => 'email',
'password' => 'password'
]
]
],
'loginAction' => [
'controller' => 'Users',
'action' => 'login'
]
]);
php cakephp login oauth authorization
php cakephp login oauth authorization
asked Nov 26 '18 at 7:37
dvn22dvn22
937
asked Nov 26 '18 at 7:37
dvn22dvn22
937
asked Nov 26 '18 at 7:37
dvn22dvn22
937
asked Nov 26 '18 at 7:37
dvn22dvn22
937
asked Nov 26 '18 at 7:37
dvn22dvn22
937
937
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37
add a comment |
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37
add a comment |
1 Answer
1
active
oldest
votes
You could always use the AuthComponent::identify() method to check a login form even in a already authenticated enviroment. See Identifying Users and Logging Them In in the CakePHP docs and AuthComponent::identify in the API docs.
Step-by-step:
- Create controller action and template for password recheck and include form for a
Userentity with controls foremailandpassword. - Prefill
emailfield if you like, a hidden field is also possible. - Add a
$this->request->is('post')block, just the way you would do in the standard login and check for valid crendential within using$user = $this->Auth->identify();. - If a valid user is returned store some flag or timestamp for timeout in your Session and then redirect to protected pages.
- On any protected controller check for existence of the flag or valid timestamp in the Controller::beforeFilter callback method and throw
UnauthorizedExceptionorForbiddenExceptionif not.
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53476556%2fcakephp-3-6-protect-inner-page-with-existin-login-form%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You could always use the AuthComponent::identify() method to check a login form even in a already authenticated enviroment. See Identifying Users and Logging Them In in the CakePHP docs and AuthComponent::identify in the API docs.
Step-by-step:
- Create controller action and template for password recheck and include form for a
Userentity with controls foremailandpassword. - Prefill
emailfield if you like, a hidden field is also possible. - Add a
$this->request->is('post')block, just the way you would do in the standard login and check for valid crendential within using$user = $this->Auth->identify();. - If a valid user is returned store some flag or timestamp for timeout in your Session and then redirect to protected pages.
- On any protected controller check for existence of the flag or valid timestamp in the Controller::beforeFilter callback method and throw
UnauthorizedExceptionorForbiddenExceptionif not.
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
add a comment |
You could always use the AuthComponent::identify() method to check a login form even in a already authenticated enviroment. See Identifying Users and Logging Them In in the CakePHP docs and AuthComponent::identify in the API docs.
Step-by-step:
- Create controller action and template for password recheck and include form for a
Userentity with controls foremailandpassword. - Prefill
emailfield if you like, a hidden field is also possible. - Add a
$this->request->is('post')block, just the way you would do in the standard login and check for valid crendential within using$user = $this->Auth->identify();. - If a valid user is returned store some flag or timestamp for timeout in your Session and then redirect to protected pages.
- On any protected controller check for existence of the flag or valid timestamp in the Controller::beforeFilter callback method and throw
UnauthorizedExceptionorForbiddenExceptionif not.
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
add a comment |
You could always use the AuthComponent::identify() method to check a login form even in a already authenticated enviroment. See Identifying Users and Logging Them In in the CakePHP docs and AuthComponent::identify in the API docs.
Step-by-step:
- Create controller action and template for password recheck and include form for a
Userentity with controls foremailandpassword. - Prefill
emailfield if you like, a hidden field is also possible. - Add a
$this->request->is('post')block, just the way you would do in the standard login and check for valid crendential within using$user = $this->Auth->identify();. - If a valid user is returned store some flag or timestamp for timeout in your Session and then redirect to protected pages.
- On any protected controller check for existence of the flag or valid timestamp in the Controller::beforeFilter callback method and throw
UnauthorizedExceptionorForbiddenExceptionif not.
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
You could always use the AuthComponent::identify() method to check a login form even in a already authenticated enviroment. See Identifying Users and Logging Them In in the CakePHP docs and AuthComponent::identify in the API docs.
Step-by-step:
- Create controller action and template for password recheck and include form for a
Userentity with controls foremailandpassword. - Prefill
emailfield if you like, a hidden field is also possible. - Add a
$this->request->is('post')block, just the way you would do in the standard login and check for valid crendential within using$user = $this->Auth->identify();. - If a valid user is returned store some flag or timestamp for timeout in your Session and then redirect to protected pages.
- On any protected controller check for existence of the flag or valid timestamp in the Controller::beforeFilter callback method and throw
UnauthorizedExceptionorForbiddenExceptionif not.
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
answered Nov 26 '18 at 21:39
Der DitschDer Ditsch
514
514
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53476556%2fcakephp-3-6-protect-inner-page-with-existin-login-form%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I don't think the built in parts can handle this. You might have to write your own logic for the specific password input. I would recommend looking into Passwordable behavior as it provides a way to re-confirm existing passwords in forms. Would not be too difficult to implement for your use case.
– mark
Nov 26 '18 at 11:37