Auth and gate components

[binaryfire]

Hi @huangdijia

Great work on your components library! Would you consider making auth and gate components as well? I'm interested in migrating from Laravel to Hyperf for webapps, and the only thing that's missing is authentication (login / logout) and permissions (gates).

[huangdijia]

Hello, thank you for your affirmation and suggestions. I will carefully consider them. Here are some excellent components related to Auth. You can take a look at them first.

• fx/hyperf-http-auth
• 96qbhy/hyperf-auth
• hyperf-ext/jwt
• hyperf-ext/auth
• donjan-deng/hyperf-casbin
• Casbin

[binaryfire]

Thanks for your suggestions @huangdijia. I checked the components you recommended. Casbin is too complex for what I need, so I'll write my own helper for permissions for now.

All the authentication components are abandoned, except 96qbhy. I will try that one and see if it works.

[hsluoyz]

@huangdijia you can also consider Casdoor: https://casdoor.org/

[huangdijia]

I took the time to adapt auth to Hyperf, and you are welcome to participate.

[binaryfire]

@huangdijia Awesome! I'd definitely like to participate.

[binaryfire]

@huangdijia Secure website login also needs CSRF protection. None of the auth components in that list have a CSRF feature, so they are all insecure!

Here is some info on CSRF:
https://laravel.com/docs/10.x/csrf
https://github.com/slimphp/Slim-Csrf
https://github.com/muhamed-didovic/csrf
https://symfony.com/doc/current/security/csrf.html

(CSRF protection is required to securely submit any session-authenticated POST/PUT/PATCH requests on the website. Login form, contact form, API endpoints etc...)

[huangdijia]

Can you create a pr, submit this feature to the https://github.com/hyperf/hyperf？ We'll finish it together.

[binaryfire]

@huangdijia I'd love to help but unfortunately my coding skills aren't good enough to create components from scratch. I can only offer suggestions and help with testing, feedback and minor PRs.

[binaryfire]

Closing. hyperf/session already includes most of the building blocks needed for implementing auth. Including CSRF token generation