I'm building an API provider using Craft and need to implement some kind of client authentication. I don't need to worry about individual users, but I'd like to require that clients authenticate in some way. My current thinking is the client can pass an authorization header header of some kind, or just use basic authentication to access the content on the Craft CMS site, I'm just not sure how to consume the header on the Craft side & validate it before serving the content. Can anyone offer up some tips on how to implement something like this using Craft?
1 Answer
It sounds like you're not necessarily interested in authenticating against Craft's current users, but you just want some type of header authentication in place.
If you set those header (via whatever means) in the API request, you can have a plugin's controller read those via HeaderHelper::getHelper($headerName) and perform whatever authentication logic that you require.
If authentication passes, let the request go through, if not, you can throw new HttpException(503);.
answered Dec 21, 2014 at 0:47
-
just thought that was particularly well answered, short of writing code. There may be other evidence you think well of things, Brad ;) Commented Jan 20, 2015 at 3:52