Sails REST API with simple AUTH

Question

I am new to sails, but after reading the document and following some examples on the Internet, I decided to make it a shot;)

I created an APP that depends on the REST web service that I want to build in the Sails Framework, but after a lot of research, I have not yet found the right solutions in the sails.

I think I want to transfer (username, password) or api_key in every web service call created from the application?

All the examples I found were related only to the session login method - not to the API key in every call.

I used this tutorial - http://jethrokuan.imtqy.com/2013/12/19/Using-Passport-With-Sails-JS.html

But only login to enter the login page - I want it to be logged in every call and still want to use the assembly in REST API projects.

The problem in my solution is that a call of this type - will not give me all the waiting users due to the default REST method - I want it to authenticate the user and give me the result.

http://example.com:1337/user/?username=test&password=xxx

What are the “best practices” for creating an APP using the REST service firewall? - "with sails"

Some of my code:

// policies/authentication.js if(req.param('username') && req.param('password')) { UserAuth.auth(req, res, function(err, user) { if (err) return res.forbidden('You are not permitted to perform this action.'); if(user) { return next(); } }); }else{ return res.forbidden('You are not permitted to perform this action.'); } 

---

 // services/UserAuth.js module.exports = { auth : function(req, res, cb) { var bcrypt = require('bcrypt'); var passport = require("passport"); passport.authenticate('local', function(err, user, info){ if (err) return cb({ error: 'auth error!', status: 400 }); if(user) { cb(null, user); } })(req, res); } } 

---

 // config/policies.js module.exports.policies = { '*': "authentication" }; 

Answer 1

First, it’s a bad practice to constantly reveal usernames and passwords in the wild. At the very least, you should consider releasing access_tokens, which expires after a while, and needs to be forwarded through the login system.

Secondly, if you want to authenticate with each request (instead of using sessions), it is better to do this using the request header, rather than putting credentials in the query string. This is especially true when using Sails drawings; otherwise, you will have to do additional work so that the drawings do not use your credentials as search criteria .

By using the header, authorization for each request becomes simple with Sails. Configure the policy in api / policy , which is called (for example) auth.js :

 module.exports = function (req, res, next) { // Find an access header var accessToken = req.header('my-auth-header'); // No header, no access if (!accessToken) {return res.forbidden();} // Find the user with that token User.findOne({accessToken: accessToken}) .exec(function(err, user) { // Handle error if (err) {return next(err);} // Handle bad access token if (!user) {return res.forbidden();} // Handle success return next(); }); } 

Then you can set any controller actions that need authentication using the config / policy.js file :

 module.exports = { SomeController: { '*': 'auth' }, ...etc... }