How to implement cross-system and cross-domain management of permissions in Laravel

As a popular PHP framework, Laravel has rich functions and an excellent extension system. In terms of implementing permission management, Laravel also provides rich support, which can easily implement various permission-related functions in the system. However, in actual applications, it may involve permission management between multiple systems, or cross-domain permission verification. In this case, you need to use Laravel's cross-system and cross-domain permission management functions.

This article will introduce how to implement cross-system and cross-domain permission management in Laravel, mainly including the following content:

1. Basic knowledge of permission management in Laravel
2. How Implementing cross-system permission management
3. How to implement cross-domain permission verification
4. Basic knowledge of permission management in Laravel

In Laravel, permission management can be done through Laravel The built-in Auth system implementation provides functions such as user authentication, authorization, and password reset. The authorization function is mainly implemented through the Gate and Policy classes.

Gate is the core class that implements authorization in Laravel. It can be used to define and determine user permissions. In Laravel, you can define Gate in the app/Providers/AuthServiceProvider.php file:

public function boot()
{
    $this->registerPolicies();

    Gate::define('update-post', function ($user, $post) {
        return $user->id === $post->user_id;
    });
}

The above example defines a Gate named "update-post" to determine whether the current user has permission to modify a certain article. The judgment condition is that the current user's ID is equal to the article's author ID.

When using Gate to determine permissions, you can directly use the authorize method:

public function update(Request $request, Post $post)
{
    $this->authorize('update-post', $post);

    //...
}

At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown. If you need to customize the exception information, you can pass in the third parameter in the text, such as:

$this->authorize('update-post', $post, '你没有权限修改这篇文章');

At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown, and the exception information is " You do not have permission to edit this article."

In the above example, we used the direct transmission of the $post object for permission judgment. Of course, if you need to pass other parameters for permission judgment, you can also pass additional data in the form of an array through the third parameter:

$this->authorize('update-post', ['post' => $post, 'extra_data' => 'foo']);

When judging in Gate, you can get the passed data through the second parameter:

Gate::define('update-post', function ($user, $post, $extra_data) {
    // can access $extra_data['extra_data'] here
    return $user->id === $post->user_id;
});

In addition to Gate, Laravel also provides another class called Policy, which can also be used to implement authorization. In contrast, Policy is more flexible and allows developers to implement more fine-grained permission control by defining a public method called can:

class PostPolicy
{
    public function canUpdate($user, Post $post)
    {
        return $user->id === $post->user_id;
    }
}

At this time, when using Gate for permission judgment, you can Use the policy method to associate Gate with Policy:

Gate::policy(Post::class, PostPolicy::class);

$this->authorize('update', $post);

In the above example, we associate the Gate and PostPolicy classes through the policy method, so that when we use the authorize method, Laravel will automatically Call PostPolicy's canUpdate method to determine permissions. At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown.

2. How to implement cross-system permission management

In actual applications, it may be necessary to transfer authorization information from one system to another. For example, when we have completed authentication and authorization in system A, we now need to perform operations in system B, but we do not want the user to need to authenticate and authorize again. At this time, we can transfer the authorization information in system A to system B to achieve seamless permission management.

In Laravel, we can use JWT (JSON Web Token) to achieve cross-system permission management. JWT is an open standard for secure transmission of information in a network environment. It specifies how to securely transmit JSON-based information over the Internet. JWT consists of three parts, namely header, payload and signature. Among them, header and payload are JSON strings encoded using Base64, while signature is a hash value generated from header, payload and secret using encryption algorithms such as HS256.

In Laravel, we can use the tymon/jwt-auth extension package to create and parse JWT. First, you need to install the tymon/jwt-auth extension package:

composer require tymon/jwt-auth

After the installation is complete, we need to perform some basic configuration of JWT. It can be configured in the config/jwt.php file, mainly including:

• secret: encryption key
• ttl: Token validity period, in minutes
• providers: User provider, used to verify user identity

return [
    // ...

    'secret' => env('JWT_SECRET', 'some-secret-string'),

    'ttl' => env('JWT_TTL', 60),

    'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),

    'providers' => [
        'users' => [
            'model' => AppModelsUser::class,
            'credentials' => ['email', 'password'],
        ],
    ],

    // ...
];

After completing the configuration, we can generate a JWT in a system and pass it to another system. In another system, the JWT parsing function can be used to obtain the user information and permission information in the JWT. Specifically, you can use the Auth::setUser method to set the parsed user information as the current user, and use Gate to determine permissions.

The following is a simple example:

In system A, we can use JWT to generate a Token and pass it to system B:

$token = JWTAuth::fromUser($user);

return redirect('http://system-b.com?token=' . $token);

In system B , we can parse the Token to extract the user information and permission information:

use IlluminateSupportFacadesAuth;
use TymonJWTAuthFacadesJWTAuth;

$token = request()->get('token');

$user = JWTAuth::parseToken()->authenticate();

Auth::setUser($user);

// ...

Gate::authorize('update', $post);

在上面的例子中，我们使用JWTAuth::parseToken()方法解析Token，成功后，通过authenticate()方法获取到用户信息，并使用Auth::setUser方法将用户信息设置为当前用户。最后，我们可以使用Gate的authorize方法判断当前用户是否有权限进行某些操作。

需要注意的是，为了保证传输安全，我们应该务必在传送Token时进行加密传输，或使用HTTPS协议进行通信。

3. 如何实现跨域的权限验证

在实际应用中，由于系统之间的跨域限制，可能会导致无法直接进行权限验证。此时，我们可以使用跨域资源共享（CORS）解决跨域问题。CORS是一种允许服务器进行跨域访问的机制，可以通过在响应头中设置Access-Control-Allow-*等相关选项实现。

在Laravel中，要启用CORS，可以使用spatie/laravel-cors扩展包。首先需要安装该扩展包：

composer require spatie/laravel-cors

然后，在config/cors.php文件中进行配置：

return [
    'paths' => ['api/*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,
];

在完成配置后，我们可以在需要使用CORS的路由或控制器中添加CORS相关中间件：

Route::group(['middleware' => ['cors']], function () {
    // ...
});  

public function update(Request $request, Post $post)
{
    $this->authorize('update-post', $post);

    //...
}

在上面的例子中，我们通过将路由或控制器添加到“cors”中间件组中，启用了CORS功能。此时，我们就可以支持跨域的权限验证了。

需要注意的是，为了避免出现安全问题，我们需要仔细配置CORS相关参数，确保只允许来自指定域名和端口的请求访问我们的系统。同时，我们也需要在服务器端使用CSRF和其他相关功能保护系统的安全。

以上就是How to implement cross-system and cross-domain management of permissions in Laravel的详细介绍。需要说明的是，本文只是提供了一些基本的实现思路和代码示例，具体的实现细节和方案根据实际的应用情况会有所不同。

The above is the detailed content of How to implement cross-system and cross-domain management of permissions in Laravel. For more information, please follow other related articles on the PHP Chinese website!