Laravel Passport（通过 PKCE 授予授权码）+ NuxtJS SPA + CSRF代币
我已经浏览了不同的帖子，但没有看到任何可以回答我的问题的内容，所以......
我正在构建一个应用程序，它有一个用 NuxtJS 构建的单独的 SPA。还有一个 Laravel 8 后端作为 API。
Laravel 护照用于身份验证。但是，我意识到我使用了密码身份验证授予，而我应该使用 PKCE 的身份验证代码授予。所以现在我正在重写它。
我遇到的问题如下：
那么想象一下用户点击登录按钮。对于代码授权，我需要重定向到保存登录表单的 API 的 Web 路由。但是我不想那样做，我想留在我的 SPA 中并使用那里的登录表单。
为此，我需要将 CSRF 令牌安全发送到前端。如您所知，Laravel 会要求这样做。我不想把它关掉。我认为它应该始终存在。现在我不知道该怎么做。
据我了解，我可以使用加密的 cookie，我的 SPA 可以从中获取 CSRF 令牌并将其发送到 Web 登录端点。我知道 Laravel sainttum 有一个发出 cookie 的端点（但请记住我使用的是护照）。
现在我最感兴趣的是了解我的观点是否正确。
是否可以执行类似的操作：
- 设置加密的 CSRF cookie
- 用户单击登录按钮，该按钮调用后端端点以在设置 cookie 后
- ，SPA 自动显示登录表单用户输入凭据并将其与 CSRF 令牌一起发送
- 只有在以下情况下才应接受令牌它来自我的 SPA 域
是否有意义并且看起来正确吗？
提前致谢！
I looked through different posts already and I didn't see anything that would answer my questions so...
I am building an app that has a separate SPA built with NuxtJS. There's also a Laravel 8 backend serving as an API.
Laravel passport is used for auth. However, I realized that I used password auth grant where I should've used auth code grant with PKCE. So now I am rewriting it.
The problem I encountered is as follows:
So imagine that the user clicks the login button. For the code auth grant, I need to redirect to the web route of my API that would hold the login form. However I do not want to do it like that, I want to stay in my SPA and use the login form there.
In order to do that I need to get the CSRF token safely to the frontend. As you know Laravel will require that. I don't want to turn it off. I think it should be there, at all times. Now I am not sure how to exactly do that.
To my understanding, I can use an encrypted cookie from which my SPA could get the CSRF token and send it to the web login endpoint. I know that Laravel sanctum has an endpoint that issues the cookie (but remember I am using passport).
Now I am mostly interested in understanding if I am right about this.
Is it ok to do something like that:
- user clicks login button which calls backend endpoint to set an encrypted CSRF cookie
- after the cookie is set, SPA automatically shows login form
- user enters credentials and sends them along with CSRF token
- token should only be accepted if it comes from my SPA domain
Does it make sense and does it seem right?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论