Different authorization header for each operation in a Guzzle client service description - guzzle

The API I'm accessing requires a custom authorization header that is a combination of the publicKey that is passed in when the client is instantiated and the complete URI of the API endpoint. I want to pull the baseUrl and operation uri out of the service description and use them to create the authorization header, but I can't figure out how to do this when calling the instantiated client.
This is the service description:
{
"name": "FranchiseSystem",
"apiVersion": "1",
"baseUrl": "https://apidev.example.com",
"description": "REST API client",
"operations": {
"GetFranchiseList": {
"httpMethod": "GET",
"uri": "v1/franchise",
"summary": "Returns an array of franchises."
},
"GetReviews": {
"httpMethod": "GET",
"uri": "v1/review",
"summary": "Returns an array of reviews."
}
}
}
This is the client setup:
$testClient = new JunknetClient([
'publicKey' => '1234567890',
]);
This is the call to the instantiated client with the name of the operation:
$result = $testClient->GetFranchiseList();
or:
$result = $testClient->GetReviews();
When testClient->GetFranchiseList is called, I need to create the authorization header using the publicKey and the values of baseUrl and uri for GetFranchiseList.
When testClient->GetReviews is called, I need to create the authorization header using the publicKey and the values of baseUrl and uri for GetReviews.

You might want to have a look at the following links from the Guzzle docs.
Request Options - Headers
Authentication Parameters

I was able to solve my problem by using and event emitter and subscriber. It's a bit messy, but it get's the job done.
private function handleCredentialsOptions(Collection $config) {
//Build authorization header from $config values
$this->getHttpClient()->getEmitter()->on('before',
function (BeforeEvent $e) use(&$config) {
$this->getHttpClient()->setDefaultOption('headers', [
'Authentication' => '',
]);
$path = $e->getRequest()->getUrl();
$authValue = $config['publicKey'].';;';
$authValue .= time().';';
$authValue .= strtoupper(md5($config['privateKey'] . $path));
$this->getHttpClient()->setDefaultOption('headers', [
'Authentication' => $authValue,
]);
});
}

Related

'Access-Control-Allow-Origin' header value not equal to the supplied origin, POST method

I get the following message in the Chrome dev tools console when submitting a contact form (making a POST request) on the /about.html section my portfolio web site:
Access to XMLHttpRequest at 'https://123abc.execute-api.us-east-1.amazonaws.com/prod/contact' from origin 'https://example.net' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value 'https://example.net/' that is not equal to the supplied origin.
I don't know how to troubleshoot this properly, any help is appreciated.Essentially, this is happening (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSAllowOriginNotMatchingOrigin) and I don't know where within my AWS assets to fix it. This person had same problem, but i'm unsure of how to apply their fix (CORS header 'Access-Control-Allow-Origin' does not match... but it does‼)
Here is a description of the AWS stack:
Context, I am using an S3 bucket as static website using CloudFront and Route 53, this stuff works fine, has for years. When I added the form, I did the following to allow the HTTP POST request:
Cloudfront, On the site's distribution I added a behavior with all settings default except:
Path pattern: /contact (I am using this bc this is the API Gateway resource path ending)
Origin and origin groups: S3-Website-example.net.s3-website... (Selected correct origin)
Viewer protocol policy: HTTP and HTTPS
Allowed HTTP methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
Cache HTTP methods GET and HEAD methods are cached by default: Checked OPTIONS box
Origin request policy - optional: CORS-S3Origin
Response headers policy - optional: CORS-With-Preflight
API Gateway, Created a REST API with all default settings except:
Created a resource: /contact
Created a method: POST
For /contact, Resource Actions > Enable CORS:
Methods: OPTIONS and POST both checked
Access-Control-Allow-Origin: 'https://example.net' (no ending slash)
Clicked "Enable CORS and Replace existing headers"
Results are all checked green:
✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Method Response Headers to OPTIONS method
✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Integration Response Header Mappings to OPTIONS method
✔ Add Access-Control-Allow-Origin Method Response Header to POST method
✔ Add Access-Control-Allow-Origin Integration Response Header Mapping to POST method
Created a stage called "prod", ensured it had the /contact resource, and deployed.
At the /contact - POST - Method Execution, The test works as expected (triggers Lambda func that uses SES to send email, which I do actually receive).
The only thing I feel unsure about with API Gateway is after I enable the CORS, I can't seem to find a place where that setting has been saved, and if I click again on enable CORS, it is back to the default form ( with Access-Control-Allow-Origin: '')*
Amazon SES, set up 2 verified identities for sending/receiving emails via lamda.
Lamda, set up a basic javascript function with default settings, the REST API is listed as a trigger, and does actually work as previously mentioned. The function code is:
var AWS = require('aws-sdk');
var ses = new AWS.SES({ region: "us-east-1" });
var RECEIVER = 'myemail#email.com';
var SENDER = 'me#example.net';
var response = {
"statusCode": 200,
"headers": {
"Content-Type": "application/json",
"Access-Control-Allow-Origin": "*"
},
"isBase64Encoded": false,
"body": "{ \"result\": \"Success\"\n}"
}
exports.handler = async function (event, context) {
console.log('Received event:', event);
var params = {
Destination: {
ToAddresses: [
RECEIVER
]
},
Message: {
Body: {
Text: {
Data: 'first name: ' + event.fname + 'last name: ' + event.lname + '\nemail: ' + event.email + '\nmessage: ' + event.message,
Charset: 'UTF-8'
}
},
Subject: {
Data: 'Website Query Form: ' + event.name,
Charset: 'UTF-8'
}
},
Source: SENDER
};
return ses.sendEmail(params).promise();
};
The only thing i can think of here is to maybe update the response to have "headers": {"Access-Control-Allow-Origin": "https://example.net"}
S3 bucket that holds the site contents, in permissions > CORS, I have the following JSON to allow a post of the contact form (notice no slash):
[
{
"AllowedHeaders": [
"*"
],
"AllowedMethods": [
"POST"
],
"AllowedOrigins": [
"https://example.net"
],
"ExposeHeaders": []
}
]
Permissions/Roles, Established Roles and permissions per
AWS guide: create dynamic contact forms for s3 static websites using aws lambda amazon api gateway and amazon ses
video titled: "Webinar: Dynamic Contact Forms for S3 Static Websites Using AWS Lambda, API Gateway & Amazon SES"
Client code, this is a very milk toast function being called to post the form on click.
function submitToAPI(event) {
event.preventDefault();
URL = "https://123abc.execute-api.us-east-1.amazonaws.com/prod/contact";
const namere = /[A-Za-z]{1}[A-Za-z]/;
const emailre = /^([\w-\.]+#([\w-]+\.)+[\w-]{2,6})?$/;
let fname = document.getElementById('first-name-input').value;
let lname = document.getElementById('last-name-input').value;
let email = document.getElementById('email-input').value;
let message = document.getElementById('message-input').value;
console.log(`first name: ${fname}, last name: ${lname}, email: ${email}\nmessage: ${message}`);
if (!namere.test(fname) || !namere.test(lname)) {
alert ("Name can not be less than 2 characters");
return;
}
if (email == "" || !emailre.test(email)) {
alert ("Please enter valid email address");
return;
}
if (message == "") {
alert ("Please enter a message");
return;
}
let data = {
fname : fname,
lname: lname,
email : email,
message : message
};
$.ajax(
{
type: "POST",
url : URL,
dataType: "json",
crossDomain: "true",
contentType: "application/json; charset=utf-8",
data: JSON.stringify(data),
success: function () {
alert("Successful");
document.getElementById("contact-form").reset();
location.reload();
},
error: function () {
alert("Unsuccessful");
}
});
}
The problem was that the response in the lambda function had "Access-Control-Allow-Origin" set to "*".
This should have been set to the exact origin (no trailing slash), so if the origin is 'https://example.net', then the response in the lamda function should have "Access-Control-Allow-Origin" set to 'https://example.net' as shown below:
var response = {
"statusCode": 200,
"headers": {
"Content-Type": "application/json",
"Access-Control-Allow-Origin": "https://example.net"
},
"isBase64Encoded": false,
"body": "{ \"result\": \"Success\"\n}"
}```

Grafana API script to create new datasource failing

I'm learning both Grafana, AND how to interact with APIs in Powershell. I was able to use the Grafana HTTP API to create a dashboard, however I cannot get the same API to create a Datasource. My code is as follows:
$header = #{"Authorization" = "Bearer apikey="}
$createDatasourceUri = "http://localhost:3000/api/datasources"
$createDatasourcejson = #'
{
"datasource": {
"name": "prometheusApiTest",
"type": "prometheus",
"url": "http://localhost:9090",
"access": "proxy",
"basicAuth": false,
"isDefault": true
}
}
'#
$datasourceParameters = #{
Method = "POST"
URI = $createDatasourceUri
Body = $createDatasourcejson
Headers = $header
ContentType = "application/json"
}
Invoke-RestMethod #datasourceParameters
I am presented with the following error:
Invoke-RestMethod : [{"fieldNames":["Name"],"classification":"RequiredError","message":"Required"},{"fieldNames":["Type"],"classification":"RequiredError","message":"Required"},{"fieldNames":["Access"],"classificat
ion":"RequiredError","message":"Required"}]
I do not know what's going on. Anything I can find about this error says I need to specify the ContentType as "application/json", but I've very clearly done so. I do receive data when I do a "GET" on that API endpoint, and even copying the data that gets returned still results in the above error. I'm at a complete loss, as this same code worked to create a dashboard (albeit with the right json payload for a dashboard). Any ideas?
The Grafana docs for the Datasource API only has the datasource element in the response, not the initial call. Line 5 of my code, and the subsequent {} for that element, are not needed, and the script functions with those lines removed.

How to send Query Params in Get Request in Robot Framework?

I am new to Robot Framework and am facing an issue while sending query params in Get Request method.
Following is the code that I tried with no luck :
Get Data With Filter
[Arguments] ${type} ${filter}
${auth} = Create List ${user_name} ${password}
${params} = Create Dictionary type=${type} filter=${filter}
Create Session testingapi url=${some_host_name} auth=${auth}
${resp} = Get Request testingapi /foo/data params=${params}
Log ${resp}
${type} has value new and ${filter} that I want is id:"1234"
I am expecting final url to formed as :
/foo/data?type=new&filter=id%3A1234
Instead of forming the expected url, I get the request url as :
GET Request using : uri=/foo/data, params={'type': 'new', 'filter': 'id:1234'}
I might be missing something very obvious but I cant figure out what it is. What can I change in this piece of code or any new code that needs to be added?
I think the logger is just outputting the params as the dictionary. The request should actually be made to foo/data?type=new&filter=id%3A1234
You can test it with the following request to Postman Echo (An HTTP testing service):
${auth} = Create List Mark SuperSecret
${params} = Create Dictionary type=Condos filter=2Bedrooms
Create Session testingapi url=http://postman-echo.com auth=${auth}
${resp} = Get Request testingapi /get params=${params}
${json} = To JSON ${resp.content} pretty_print=True
Log \n${json} console=yes
The response will correctly list the params you've encoded:
{
"args": {
"filter": "2Bedrooms",
"type": "Condos"
},
"headers": {
"accept": "*/*",
"accept-encoding": "gzip, deflate",
"authorization": "Basic TWFyazpTdXBlclNlY3JldA==",
"host": "postman-echo.com",
"user-agent": "python-requests/2.25.0",
"x-amzn-trace-id": "Root=1-5fb43ae9-1880b0a621c864b06ce1f54a",
"x-forwarded-port": "80",
"x-forwarded-proto": "http"
},
"url": "http://postman-echo.com/get?type=Condos&filter=2Bedrooms"
}

What would be the integration uri for aws apigateway swagger file for query params?

"paths": {
"/{x}/{y}": {
"put": {
x-amazon-apigateway-integration": {
"uri": "https://hostname/contextpath/{x}/{y}"
"httpMethod": "PUT",
"type": "http"
}
}
}
If I do have query params for that resource then my invoke url would be https://apiid.execute-api.us-east-2.amazonaws.com/dev/x/y?queryparam1=value1&queryparam2=value2&queryparam3=value3&queryparam4=value4.
what would be my uri type in the integration request for my http backend?
How do I pass query params when calling it https://hostname/contextpath/{x}/{y}?=&= ? Can anyone suggest me how to pass query params when integrating with http type?

Slim 3 how to save JWT Token on local storage and use it in my routes for authentication

I want to implement jwt authentication for slim app, i followed tuupora's PRS7 jwt authentication middleware and its working fine when i use Postman because there are options to use header as "Authorization: Bearer tokenString" as here bellow when i request "/auth/ibice" route
these returned data are protected by the middleware-- screenshot
and am using the token string that returned when i request this route "/authtoken" as you see it bellow
{
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ3d3cuYXNpZC5ydyIsImlhdCI6MTQ4Njk5MjcyNCwiZXhwIjoxNDg4Mjg4NzI0LCJjb250ZXh0Ijp7InVzZXIiOnsicGhvbmVubyI6IjA3ODQyMjY4OTUiLCJ1c2VyX2lkIjoiMSJ9fX0.1kFu4A16xxJriaRA9CccIJ3M9Bup06buK2LAh13Lzy4",
"user_id": "1"
}
this my middleware.php that protect all routes of "/auth/"
<?php
// Application middleware
$container["jwt"] = function ($container) {
return new StdClass;
};
$app->add(new \Slim\Middleware\JwtAuthentication([
"environment" => "HTTP_X_TOKEN",
"header" => "Authorization",
"path" => ["/auth"],
"passthrough" => ["/authtoken"],
"secret" => "your_secret_key",
"error" => function ($request, $response, $arguments) {
$data["status"] = "error";
$data["message"] = $arguments["message"];
return $response->withStatus(401)
->withHeader("Content-Type", "application/json")
->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));
},
"callback" => function ($request, $response, $arguments) use ($container) {
$container["jwt"] = $arguments["decoded"];
}
]));
and my routes that i want to request with authorization header that is stored either from cookie or local storage but i have no idea how to do that!!
$app->group('/auth',function(){
$this->get('/admin','App\Controllers\apiController:login')->setName('admin');
//fetch ibice
$this->get('/ibice','App\Controllers\apiController:ibice')->setName('Ibice');
//fetch ibice by id
$this->get('/igice/{id}', 'App\Controllers\apiController:igice')->setName('igiceId');
//search ibice
$this->get('/igice/search/[{query}]', 'App\Controllers\apiController:igice_search')->setName('Igice Search');
//imitwe igize igice
$this->get('/igice/{id}/imitwe','App\Controllers\apiController:imitwe')->setName('Imitwe');
//ingingo ziherereye mumutwe runaka
$this->get('/umutwe/{id}/ingingo', 'App\Controllers\apiController:ingingoBundle')->setName('Ingingo.bundle');
//ingingo ziri mucyiciro runaka
$this->get('/ingingo/icyiciro/{id}', 'App\Controllers\apiController:allstuff')->setName('Icyiciro');
//kuzana ikibazo kimwe kiri mungingo runaka
$this->get('/ingingo/{ingingoid}/question/{id}', 'App\Controllers\apiController:question')->setName('One_Exercise');
//kuzana ibibazo byose biri mungingo
$this->get('/ingingo/{ingingoid}/questions', 'App\Controllers\apiController:questions')->setName('One_Exercise');
//check if the answer is True or False
$this->get('/question/{id}/check/[{query}]','App\Controllers\apiController:checkQuestions')->setName('Check_Questions');
//get questions ids from ingingo
$this->get('/question/{ingingoid}','App\Controllers\apiController:questionsIDs')->setName('Check_Questions');
});
please help me i have no idea how to do this !!
I have never used Slim before but Maybe You can use little Javascript to access localstorage bcz you can't access local storage with php (php works on server side) while localstorage is in browser(client side) here there steps you can do first get Auth token with php by hitting this /authtoken endpoint $app->get('/authtoken') then you need to json_decode returned json into php array then if suppose your php array containing token is $arr then you can you little javascript to save that token in localstorage likes this <script>localStorage.setItem('token', '<?php echo $arr['token'];?>');</script> then whenever you want to read it also you can use javascript to read it from localstorage
<?php
$token = "<script>document.write(localStorage.getItem('token'));</script>"; ?>