0

这是我的控制器

class ClientController extends ActiveController
{
    public $modelClass = 'common\models\Client'; 
    public $serializer = [
      'class' => 'yii\rest\Serializer',
      'collectionEnvelope' => 'items',
  ];
    public function behaviors()
    {

        return ArrayHelper::meenter code hererge(parent::behaviors(),[
          [
            'class' => \yii\filters\Cors::className(),
        ],
           [
           'class' => CompositeAuth::className(),
           'except' => ['options'],
           'authMethods' => [
           HttpBearerAuth::className(),
             QueryParamAuth::className(),

           ],
        ],

           [
           'class' => TimestampBehavior::className(),
           ],
             [
              'class' => 'yii\filters\ContentNegotiator',
              'only' => ['view', 'index'],  // in a controller
              // if in a module, use the following IDs for user actions
              // 'only' => ['user/view', 'user/index']
              'formats' => [
                  'application/json' => Response::FORMAT_JSON,
              ],

          ],
           [
           'class' => AccessControl::className(),
    // We will override the default rule config with the new AccessRule class
           'ruleConfig' => [
           'class' => AccessRule::className(),
           ],
           'only' => ['create', 'delete'],
           'rules' => [[
           'actions' => ['create'],
           'allow' => true,
            // Allow users, moderators and admins to create
           'roles' => [
           User::ROLE_ADMIN
           ],
        ],

           [
           'actions' => ['delete'],
           'allow' => true,
            // Allow admins to delete
           'roles' => [
           User::ROLE_ADMIN
           ],
        ],
      ],
    ],
  ]);

  }
   public function actions(){
       $actions = parent::actions();
      unset( $actions['create']);
      return $actions;
   }
   public function actionCreate(){

       $model = new \common\models\Client();
       $transaction = Yii::$app->db->beginTransaction();
       try 
       {

        $model->load(Yii::$app->getRequest()->getBodyParams(), '');
        $user_create = \common\models\User::user_create($model);
        if($user_create){
           $model->user_id = $user_create->id;
          if($model->save()){
            $transaction->commit();
            return $model;
          }
        }

       }
        catch (Exception $e) 
        {
          $transaction->rollBack();
          return null;
        }    
   }
Here is my User Model
class User extends ActiveRecord implements IdentityInterface
{

    public static function findIdentity($id)
    {
        return static::findOne(['id' => $id, 'status' => self::STATUS_ACTIVE]);
    }
    public function generateAccountActivationToken()
    {
        $this->account_activation_token = Yii::$app->security->generateRandomString() . '_' . time();
    }
    /**
     * @inheritdoc
     */
    // public static function findIdentityByAccessToken($token, $type = null)
    // {
    //     throw new NotSupportedException('"findIdentityByAccessToken" is not implemented.');
    // }
    public static function findIdentityByAccessToken($token, $type = null)
    {
        return static::findOne(['auth_key' => $token]);
    }
    /**
     * Finds user by username
     *
     * @param string $username
     * @return static|null
     */
    public static function findByUsername($username)
    {
        return static::findOne(['username' => $username, 'status' => self::STATUS_ACTIVE]);
    }

    /**
     * Finds user by password reset token
     *
     * @param string $token password reset token
     * @return static|null
     */
    public static function findByPasswordResetToken($token)
    {
        $expire = Yii::$app->params['user.passwordResetTokenExpire'];
        $parts = explode('_', $token);
        $timestamp = (int) end($parts);
        if ($timestamp + $expire < time()) {
            // token expired
            return null;
        }

    /**
     * @inheritdoc
     */
    public function getId()
    {
        return $this->getPrimaryKey();
    }

    /**
     * @inheritdoc
     */
    public function getAuthKey()
    {
        return $this->auth_key;
        // return null;

    }

    /**
     * @inheritdoc
     */
    public function validateAuthKey($authKey)
    {
        return $this->getAuthKey() === $authKey;
    }

    /**
     * Generates "remember me" authentication key
     */
    public function generateAuthKey()
    {
        $this->auth_key = Yii::$app->security->generateRandomKey();

    }


    public function beforeSave($insert)
    {
        if (parent::beforeSave($insert)) {
            if ($this->isNewRecord) {
                $this->auth_key = \Yii::$app->security->generateRandomString();
            }
            return true;
        }
        return false;
    }
}

这里的问题是当我发送发布请求时它返回 401 错误。我知道这是认证错误它甚至没有命中函数 public static function findIdentityByAccessToken($token, $type = null) { return static::findOne(['auth_key' => $令牌]); 我知道问题出在 HttpBearerAuth::className()。我怎么能在这里解决这个错误是图像 在此处输入图像描述

4

1 回答 1

1

关于声明

它甚至没有降落在findIdentityByAccessToken()

来自DOCS

身份验证后,对于每个 API 请求,请求的控制器将尝试在其beforeAction()步骤中对用户进行身份验证。

如果身份验证成功,控制器将执行其他检查(例如速率限制、授权),然后运行该操作。经认证的用户身份信息可以通过 Yii::$app->user->identity.

如果身份验证失败,HTTP 状态 401 的响应将与其他适当的标头(例如 HTTP 基本身份验证的 WWW-Authenticate 标头)一起发回。

HttpBearerAuthextendsHttpHeaderAuth这是一个支持 HTTP 身份验证的操作过滤器HTTP Headers,查看该HttpHeaderAuth函数的源代码,authenticate($user, $request, $response)您将看到它在第一行获取 auth 标头

$authHeader = $request->getHeaders()->get($this->header);

并且$identity仅当authHeaders不是时才返回null,否则它null从方法返回并且您甚至没有登陆就authenticate($user, $request, $response)收到错误。 401findIdentityByAccesToken()

你应该做的是

  • 打开postman并单击Authorization选项卡

在此处输入图像描述

  • Type从下拉列表中选择BearerToken

在此处输入图像描述

  • 在右侧auth_key为您发送请求的用户添加来自用户表的

在此处输入图像描述

  • 单击Preview Request按钮,您将看到消息请求标头已更新

在此处输入图像描述

现在,如果您转到Headers选项卡旁边的Authorization选项卡,您将看到key=>value一对授权标头

在此处输入图像描述

现在单击发送按钮并查看您的请求,我会建议您注释掉当前操作中的所有内容,只需添加一个echo "hello";声明即可知道它已到达那里。


您可以通过 curl 通过以下方式发送标头进行身份验证

curl -d "param1=value1&param2=value2" 
-H "Content-Type: application/x-www-form-urlencoded" 
-H "Authorization: Bearer YOUR_TOKEN_" 
-X POST http://localhost:3000/data
于 2018-05-11T22:26:05.793 回答