Symfony 3 + JWT + angular 2 + Authentication (option method)

Question

I'm just trying to create my sf3 api using login using JWT, but I am having authentication issues. So, here are my configurations and some tests that I understood.

security.yml:

security:
    firewalls:
        login:
        pattern:    ^/api/auth
        stateless:  true
        anonymous:  true
        form_login:
            check_path:                 /api/auth/login-check
            success_handler:            lexik_jwt_authentication.handler.authentication_success
            failure_handler:            lexik_jwt_authentication.handler.authentication_failure
            require_previous_session:   false

        api:
            pattern:   ^/api
            stateless: true
            lexik_jwt: ~
    access_control:
        - { path: ^/api/auth, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api,      roles: IS_AUTHENTICATED_FULLY }

routing.yml:

auth:
    path:       /auth
    defaults:   { _controller: api.controller.auth:postAction }
    methods:    [OPTIONS, POST]

api_login_check:
    path:       /auth/login-check

config.yml:

nelmio_cors:
    paths:
        '^/api/':
            allow_origin: ['*']
            allow_headers: ['*']
            allow_methods: ['POST', 'PUT', 'GET', 'DELETE', 'OPTIONS']
            max_age: 3600

When I debug routing, I get this output:

$ php bin/console debug:router
----------------------------------- ------------------ -------- ------ -----------------------------------
 Name                                Method             Scheme   Host   Path
----------------------------------- ------------------ -------- ------ -----------------------------------
....
api_homepage                        ANY                ANY      ANY    /api/
auth                                OPTIONS|POST       ANY      ANY    /api/auth
api_login_check                     ANY                ANY      ANY    /api/auth/login-check
....

So far so good, now there are problems.

I was able to verify the authentication return using

$ curl -v -X POST http://api.local/api/auth/login-check -d _username=user -d _password=user
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to api.local (127.0.0.1) port 80 (#0)
> POST /api/auth/login-check HTTP/1.1
> Host: api.local
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Length: 33
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 33 out of 33 bytes
< HTTP/1.1 200 OK
< Server: nginx/1.10.3
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Powered-By: PHP/7.1.3
< Set-Cookie: PHPSESSID=c4o6kuelf914gjnq09m38ec0c7; path=/; HttpOnly
< Cache-Control: no-cache, private
< Date: Fri, 12 May 2017 16:37:23 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, POST, OPTIONS, DELETE, PUT
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Headers: User-Agent,Keep-Alive,Content-Type,Access-Control-Allow-Headers
<
* Curl_http_done: called premature == 0
* Connection #0 to host api.local left intact
{"token":"b2xlc9.......DW6uAwx4"}

Great, it works!

When I try to use the same request in the browser, I get 404 in the OPTIONS method, so I try to recreate the request using curl OPTIONS request (really, I don’t know if it makes any sense, but I tried it anyway , where's the answer:

$ curl -v -X OPTIONS http://api.local/api/auth/login-check -d _username=user -d _password=user
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to api.local (127.0.0.1) port 80 (#0)
> OPTIONS /api/auth/login-check HTTP/1.1
> Host: api.local
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Length: 33
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 33 out of 33 bytes
< HTTP/1.1 404 Not Found
< Server: nginx/1.10.3
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Powered-By: PHP/7.1.3
< Cache-Control: no-cache, private
< Date: Fri, 12 May 2017 16:35:49 GMT
<
{"error":{"code":404,"message":"Not Found"}}
* Curl_http_done: called premature == 0
* Connection #0 to host api.local left intact

, api OPTIONS, : [OPTIONS, POST] api_login_check, .

nelmioCorsBundle, .

, , ?

Answer 1

auth- /oauth routing.yml, /api/auth . , .

- , , CURL,

OPTIONS , , NelmioCorsBundle .

, /api , nelmio_cors .

nelmio_cors:
    defaults:
        allow_credentials: false
        allow_origin: []
        allow_headers: []
        allow_methods: []
        expose_headers: []
        max_age: 0
        hosts: []
        origin_regex: false
    paths:
        '^/':
            allow_origin: ['*']
            allow_headers: ['accept', 'authorization', 'content-type']
            allow_methods: ['OPTIONS', 'POST', 'PUT', 'PATCH', 'GET', 'DELETE']
            max_age: 3600