lonnieezell / myth-auth

One-stop Auth package for CodeIgniter 4
MIT License
633 stars 206 forks source link

auth page not working when I add login filter globally #393

Closed bi2b closed 3 years ago

bi2b commented 3 years ago

I want to make all my website pages inaccessible when the user hasn't logged in first, I use a global login filter but the auth page doesn't work as usual

my filters config code:

public $aliases = [
    'csrf'     => CSRF::class,
    'toolbar'  => DebugToolbar::class,
    'honeypot' => Honeypot::class,
    'login'      => \Myth\Auth\Filters\LoginFilter::class,
'role'       => \Myth\Auth\Filters\RoleFilter::class,
'permission' => \Myth\Auth\Filters\PermissionFilter::class
];

/**
 * List of filter aliases that are always
 * applied before and after every request.
 *
 * @var array
 */
public $globals = [
    'before' => [
        'login'
        // 'honeypot',
        // 'csrf',
    ],
    'after'  => [
        'toolbar',
        // 'honeypot',
    ],
];
lonnieezell commented 3 years ago

Have you made custom authentication endpoints? The LoginFilter checks for a number of the auth routes based on their alias, ie. login, register, etc, which are defined by default. If you specify your own, you must make sure the aliases are still there or it will try to protect the auth pages also.

bi2b commented 3 years ago

i just use the default routes. the page is not working when i click submit button on login page, and when i click submit button on register page, my new user can't be registered and redirect me to login page.

bi2b commented 3 years ago

i think the page is not working when it has post request

MGatner commented 3 years ago

Can you try this?


public $globals = [
    'before' => [
        'login' => ['except' => 'login']

The filter checks for itself and exempts the run but just in case the recursion is causing problems.

MGatner commented 3 years ago

You need to read up on how Filters work. You are applying an intercept to the Auth pages themselves. I thought there were exceptions in place to check for this, but regardless those should not be relied on to account for improper configuration. You should either apply the only to the routes you need or add exemptions for the ones you don't.

MGatner commented 3 years ago

This is a configuration issue, not a problem with the library. If you need support please go to Discussions or visit the CodeIgniter Addins Forums.