laravel / passport

Laravel Passport provides OAuth2 server support to Laravel.
https://laravel.com/docs/passport
MIT License
3.29k stars 780 forks source link

Passport::hashClientSecrets(); breaks my authentication #1643

Closed Anhleidvig closed 1 year ago

Anhleidvig commented 1 year ago

Description:

I tried to implement oath2 with my application. I followed the steps and I created a route: Route::post('/login', [AuthenticatedSessionController::class, 'store'])->middleware('guest') ->name('login');

The action:

public function store(LoginRequest $request): JsonResponse
    {
        $request->authenticate();

        /** @var User $user */
        $user = Auth::user();
        $token = $user->createToken($user->name);

        return response()->json($user->toArray());
    }

When I try to use the createToken method the API tells me this: Client authentication failed

After some digging I realised that this method is the problem:

protected function createRequest($client, $userId, array $scopes)
    {
        $secret = Passport::$hashesClientSecrets ? $this->clients->getPersonalAccessClientSecret() : $client->secret;

        return (new ServerRequest('POST', 'not-important'))->withParsedBody([
            'grant_type' => 'personal_access',
            'client_id' => $client->getKey(),
            'client_secret' => $secret,
            'user_id' => $userId,
            'scope' => implode(' ', $scopes),
        ]);
    }

The $secret is always null when the Passport::hashClientSecrets(); is inside my AuthServiceProvider::boot method.

Steps To Reproduce:

  1. Install laravel/passport
  2. php artisan migrate
  3. php artisan passport:install --uuids
  4. set the api guard
  5. set Passport::hashClientSecrets(); inside AuthServiceProvider
  6. Send a request to the route above

Update: If I try to do a normal /oauth/token request it works. The createToken method still is a problem.

Anhleidvig commented 1 year ago

I'm sorry I forgot to set: PASSPORT_PERSONAL_ACCESS_CLIENT_ID PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET

This is my bad