Slim Basic Auth Laravel Package

Added

• Username is now passed to error callback when authentication fails.

$app->add(new \Slim\Middleware\HttpBasicAuthentication([
    "users" => [
        "root" => "t00r",
        "somebody" => "passw0rd"
    ],
    "error" => function ($request, $response, $arguments) {
        var_dump($arguments["user"]);
        var_dump($arguments["message"]);
    }
]));

This is a security release.

RequestPathRule now removes multiple slashes from the URI before determining whether the path should be authenticated or not. For HTTP client /foo and //foo are different URIs and technically valid according to RFC3986. However on serverside it depends on implementation and often /foo, //foo and even /////foo are considered a same route.

Different PSR-7 implementations were behaving in different way. Diactoros removes multiple leading slashes. By default Slim does not alter any slashes. However when installed in subfolder Slim removes all slashes.

This means if you are authenticating a subfolder, for example /api and Slim is installed in document root it was possible to bypass authentication by doing a request to //api. Problem did not exist if Slim was installed in subfolder. Diactoros was not affected.

$app->add(new \Slim\Middleware\HttpBasicAuthentication([
    "path" => "/api",
    "users" => [
        "root" => "t00r",
        "somebody" => "passw0rd"
    ]
]));

If you were using default setting of authenticating all routes you were not affected.

$app->add(new \Slim\Middleware\HttpBasicAuthentication([
    "users" => [
        "root" => "t00r",
        "somebody" => "passw0rd"
    ]
]));

Fixed

• Ported fix for bug slim-jwt-auth/50 where in some cases it was possible to bypass authentication by adding multiple slashes to request URI.

I was lazy and did no keep a changelog before this.

Added

• Option to trust X-Forwarded-Proto and X-Forwarded-Port when detecting https requests

Changed

• Namespace changed from Slim\Middleware to Tuupola\Middleware
• Middleware now uses only Authorization header from the PSR-7 request. Both PHP_AUTH_USER and PHP_AUTH_PW globals as well as HTTP_AUTHORIZATION environment are now ignored.
• The callback setting was renamed to before. It is called before executing other middlewares in the stack.
• The passthrough setting was renamed to ignore.
• Public setter methods addRule() and withRules() are now immutable.
• PSR-7 double pass is now supported via tuupola/callable-handler library.
• PHP 7.1 is now minimal requirement.
• Error callback now receives only response and arguments, request was removed.
• Before callback now receives only request and arguments, response was removed.
• After callback now receives only response and arguments, request was removed.

Added

• Support for the approved version of PSR-15.
• New after callback. It is called after executing other middlewares in the stack.

Removed

• Most setters and getters for settings. Pass settings in an array only during initialization.