|
1 | 1 | # Protecting an API with HMAC Keys |
2 | 2 |
|
3 | | -> **Note** |
4 | | -> For the purpose of this documentation and to maintain a level of consistency with the Authorization Tokens, |
| 3 | +!!! note |
| 4 | + |
| 5 | + For the purpose of this documentation and to maintain a level of consistency with the Authorization Tokens, |
5 | 6 | the term "Token" will be used to represent a set of API Keys (key and secretKey). |
6 | 7 |
|
7 | 8 | HMAC Keys can be used to authenticate users for your own site, or when allowing third-party developers to access your |
8 | 9 | API. When making requests using HMAC keys, the token should be included in the `Authorization` header as an |
9 | 10 | `HMAC-SHA256` token. |
10 | 11 |
|
11 | | -> **Note** |
12 | | -> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by |
13 | | -> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file. |
| 12 | +!!! note |
| 13 | + |
| 14 | + By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by |
| 15 | + setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file. |
14 | 16 |
|
15 | 17 | Tokens are issued with the `generateHmacToken()` method on the user. This returns a |
16 | 18 | `CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The |
@@ -63,9 +65,10 @@ $token = $user->generateHmacToken('token-name', ['users-read']); |
63 | 65 | return json_encode(['key' => $token->secret, 'secretKey' => $token->secret2]); |
64 | 66 | ``` |
65 | 67 |
|
66 | | -> **Note** |
67 | | -> At this time, scope names should avoid using a colon (`:`) as this causes issues with the route filters being |
68 | | -> correctly recognized. |
| 68 | +!!! note |
| 69 | + |
| 70 | + At this time, scope names should avoid using a colon (`:`) as this causes issues with the route filters being |
| 71 | + correctly recognized. |
69 | 72 |
|
70 | 73 | When handling incoming requests you can check if the token has been granted access to the scope with the `hmacTokenCan()` method. |
71 | 74 |
|
@@ -111,5 +114,6 @@ parses the raw token and looks it up the `key` portion in the database. Once fou |
111 | 114 | to validate the remainder of the Authorization raw token. If it passes the signature test it can determine the correct user, |
112 | 115 | which will then be available through an `auth()->user()` call. |
113 | 116 |
|
114 | | -> **Note** |
115 | | -> Currently only a single scope can be used on a route filter. If multiple scopes are passed in, only the first one is checked. |
| 117 | +!!! note |
| 118 | + |
| 119 | + Currently only a single scope can be used on a route filter. If multiple scopes are passed in, only the first one is checked. |
0 commit comments