Laravel 9密码确认中间件功能不起作用

huangapple
go评论95阅读模式
英文:

Laravel 9 password.confirm middleware feature not working

问题

我正在尝试在我的一些需要安全保护的路由中使用password.confirm中间件。我希望用户在生成特定的POST请求时应该确认他的密码。

此外，password.confirm中间件已添加到app/Http/Kernel.php文件的$routeMiddleware属性中。

这是我的web.php中路由的样子。

  1. Route::post('fetchResult', [ReportController::class, 'fetchResult'])->name('fetchComplaintResult')->middleware('password.confirm');

但它不起作用。当我生成POST请求时，它直接命中到控制器的fetchResult方法，与往常一样。

我的控制器函数：

  1. public function fetchResult(Request $request)
  2. {
  3.     Model::create([
  4.         'id' => $request->id,
  5.         'action' => $request->action,
  6.         'comments' => $request->comment
  7.     ]);
  8.     // 其他操作
  9. }

我是否遗漏了什么？

英文:

I am trying to use the password.confirm middleware in some of my routes which I need to be secured. I want a user should confirm his password when he generate a specific post request.

Also, password.confirm middleware is added $routeMiddleware property in the app/Http/Kernel.php file.

This is what my route looks like in web.php.

  1. Route::post('fetchResult', [ReportController::class, 'fetchResult'])->name('fetchComplaintResult')->middleware('password.confirm');

But it is not working. When I generate post request it directly hit to controller fetchResult method as usual.

My controller function:

  1. public function fetchResult(Request $request)
  2. {
  3.         Model::create([
  4.             'id' => $request->id,
  5.             'action' => $request->action,
  6.             'comments' => $request->comment
  7.         ]);
  8.        // Other Action
  9. }

Am I missing something ??

答案1

得分: 2

如果你想在每次需要确认密码时得到提示，你应该像这样编写你的路由：

  1. Route::post('fetchResult', [ReportController::class, 'fetchResult'])
  2.     ->name('fetchComplaintResult')
  3.     ->middleware('password.confirm:password.confirm,1');

为什么？

password.confirm 中间件映射到 Illuminate\Auth\Middleware\RequirePassword 类。以下是它的代码。

  1. use Closure;
  2. use Illuminate\Contracts\Routing\ResponseFactory;
  3. use Illuminate\Contracts\Routing\UrlGenerator;
  5. class RequirePassword
  6. {
  7.     /**
  8.      * The response factory instance.
  9.      *
  10.      * @var \Illuminate\Contracts\Routing\ResponseFactory
  11.      */
  12.     protected $responseFactory;
  14.     /**
  15.      * The URL generator instance.
  16.      *
  17.      * @var \Illuminate\Contracts\Routing\UrlGenerator
  18.      */
  19.     protected $urlGenerator;
  21.     /**
  22.      * The password timeout.
  23.      *
  24.      * @var int
  25.      */
  26.     protected $passwordTimeout;
  28.     /**
  29.      * 创建一个新的中间件实例。
  30.      *
  31.      * @param  \Illuminate\Contracts\Routing\ResponseFactory  $responseFactory
  32.      * @param  \Illuminate\Contracts\Routing\UrlGenerator  $urlGenerator
  33.      * @param  int|null  $passwordTimeout
  34.      * @return void
  35.      */
  36.     public function __construct(ResponseFactory $responseFactory, UrlGenerator $urlGenerator, $passwordTimeout = null)
  37.     {
  38.         $this->responseFactory = $responseFactory;
  39.         $this->urlGenerator = $urlGenerator;
  40.         $this->passwordTimeout = $passwordTimeout ?: 10800;
  41.     }
  43.     /**
  44.      * 处理传入的请求。
  45.      *
  46.      * @param  \Illuminate\Http\Request  $request
  47.      * @param  \Closure  $next
  48.      * @param  string|null  $redirectToRoute
  49.      * @param  int|null  $passwordTimeoutSeconds
  50.      * @return mixed
  51.      */
  52.     public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)
  53.     {
  54.         if ($this->shouldConfirmPassword($request, $passwordTimeoutSeconds)) {
  55.             if ($request->expectsJson()) {
  56.                 return $this->responseFactory->json([
  57.                     'message' => 'Password confirmation required.',
  58.                 ], 423);
  59.             }
  61.             return $this->responseFactory->redirectGuest(
  62.                 $this->urlGenerator->route($redirectToRoute ?? 'password.confirm')
  63.             );
  64.         }
  66.         return $next($request);
  67.     }
  69.     /**
  70.      * 确定确认超时是否已过期。
  71.      *
  72.      * @param  \Illuminate\Http\Request  $request
  73.      * @param  int|null  $passwordTimeoutSeconds
  74.      * @return bool
  75.      */
  76.     protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
  77.     {
  78.         $confirmedAt = time() - $request->session()->get('auth.password_confirmed_at', 0);
  80.         return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);
  81.     }
  82. }

需要注意的重要部分是 handle 方法的签名：

  1. public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)

在这里，$redirectToRoute 和 $passwordTimeoutSeconds 是我们可以在路由文件中设置的参数。

$redirectToRoute 在 handle 方法中像这样使用：

  1. $this->urlGenerator->route($redirectToRoute ?? 'password.confirm')

$passwordTimeoutSeconds 在 shouldConfirmPassword 方法中使用：

  1. return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);

由于它被设置为 null，所以与之比较的值是 $this->passwordTimeout，它在构造函数中被设置为 10800（10800 秒 = 180 分钟 = 3 小时）。

因此，总结一下，我们需要设置 $passwordTimeoutSeconds 参数。由于它是第二个参数，我们还需要设置 $redirectToRoute 参数。

更多信息，请参考 Laravel 文档。

英文:

If you want to get prompted to confirm your password every time you should write your route like this:

  1. Route::post('fetchResult', [ReportController::class, 'fetchResult'])
  2.     ->name('fetchComplaintResult')
  3.     ->middleware('password.confirm:password.confirm,1');

Why?

The password.confirm middleware maps to the Illuminate\Auth\Middleware\RequirePassword class. This is its code.

  1. use Closure;
  2. use Illuminate\Contracts\Routing\ResponseFactory;
  3. use Illuminate\Contracts\Routing\UrlGenerator;
  5. class RequirePassword
  6. {
  7.     /**
  8.      * The response factory instance.
  9.      *
  10.      * @var \Illuminate\Contracts\Routing\ResponseFactory
  11.      */
  12.     protected $responseFactory;
  14.     /**
  15.      * The URL generator instance.
  16.      *
  17.      * @var \Illuminate\Contracts\Routing\UrlGenerator
  18.      */
  19.     protected $urlGenerator;
  21.     /**
  22.      * The password timeout.
  23.      *
  24.      * @var int
  25.      */
  26.     protected $passwordTimeout;
  28.     /**
  29.      * Create a new middleware instance.
  30.      *
  31.      * @param  \Illuminate\Contracts\Routing\ResponseFactory  $responseFactory
  32.      * @param  \Illuminate\Contracts\Routing\UrlGenerator  $urlGenerator
  33.      * @param  int|null  $passwordTimeout
  34.      * @return void
  35.      */
  36.     public function __construct(ResponseFactory $responseFactory, UrlGenerator $urlGenerator, $passwordTimeout = null)
  37.     {
  38.         $this->responseFactory = $responseFactory;
  39.         $this->urlGenerator = $urlGenerator;
  40.         $this->passwordTimeout = $passwordTimeout ?: 10800;
  41.     }
  43.     /**
  44.      * Handle an incoming request.
  45.      *
  46.      * @param  \Illuminate\Http\Request  $request
  47.      * @param  \Closure  $next
  48.      * @param  string|null  $redirectToRoute
  49.      * @param  int|null  $passwordTimeoutSeconds
  50.      * @return mixed
  51.      */
  52.     public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)
  53.     {
  54.         if ($this->shouldConfirmPassword($request, $passwordTimeoutSeconds)) {
  55.             if ($request->expectsJson()) {
  56.                 return $this->responseFactory->json([
  57.                     'message' => 'Password confirmation required.',
  58.                 ], 423);
  59.             }
  61.             return $this->responseFactory->redirectGuest(
  62.                 $this->urlGenerator->route($redirectToRoute ?? 'password.confirm')
  63.             );
  64.         }
  66.         return $next($request);
  67.     }
  69.     /**
  70.      * Determine if the confirmation timeout has expired.
  71.      *
  72.      * @param  \Illuminate\Http\Request  $request
  73.      * @param  int|null  $passwordTimeoutSeconds
  74.      * @return bool
  75.      */
  76.     protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
  77.     {
  78.         $confirmedAt = time() - $request->session()->get('auth.password_confirmed_at', 0);
  80.         return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);
  81.     }
  82. }

The important parts to note are the handle method's signature:

  1. public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)

Here, $redirectToRoute and $passwordTimeoutSeconds are arguments we can set in the route file.

$redirectToRoute is used like this in the handle method:

  1. $this->urlGenerator->route($redirectToRoute ?? 'password.confirm')

$passwordTimeoutSeconds is used here in the shouldConfirmPassword method.

  1. return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);

Since it's set to null, the value $confirmedAt is compared to is $this->passwordTimeout, which is set in the constructor to 10800. (10800 seconds = 180 minutes = 3 hours).

So in summary we need to set the $passwordTimeoutSeconds parameter. Since it's the second parameter, we also need to set the $redirectToRoute parameter.

https://laravel.com/docs/9.x/middleware#middleware-parameters

huangapple
  • 本文由 发表于 2023年2月6日 15:04:39
  • 转载请务必保留本文链接：https://go.coder-hub.com/75358255.html
  • authentication
  • laravel
  • laravel-9
  • middleware
  • php
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定