Symfony2 rest api security configuration (Trying to understand)

Question

I', working on a rest api with Symfony2 (FOSRestBundle, FOSOauthBundle, JMSBundle) and I do not understand (and don't find) how I'm supposed to setup my angularjs app to access my api resources. I'm a bit confused about the security part and have a lot of question.

1- I prepared the oauth client. since angular code is exposed I'm pretty sure that I can't add my secret and client id inside the code for authentication so I'm stack. H

2- I'm having (No 'Access-Control-Allow-Origin') error when I try to access the resources. How can I simply allow my app to access the resources (CORS! nelmio/cors-bundle?) but then I'm getting confused about the role of oauth and CORS authorization of my app.

Any help will be appreciate. Thanks

CORS is not a function of authentication - that's just a way to relax the same origin policy. So don't let that confuse you - CORS and OAuth are doing different, mutually exclusive things. en.wikipedia.org/wiki/Same-origin_policy — Peter Bailey
– Peter Bailey, Commented Apr 30, 2015 at 12:12

Peter Bailey · Accepted Answer · 2015-04-30 13:42:46Z

1

You can expose. It's not fully authorization. It's only a client auth, not a user.

NelmioCorsBundle is a good choice. You need a config like this:

nelmio_cors:
    defaults:
        allow_credentials: false
        allow_origin: []
        allow_headers: []
        allow_methods: []
        expose_headers: []
        max_age: 0
        hosts: []
    paths:
        '^/':
            allow_origin: ['*']
            allow_headers: ['origin', 'x-requested-with', 'content-type', 'authorization']
            allow_methods: ['POST', 'PUT', 'GET', 'DELETE', 'OPTIONS']
            max_age: 0

There is allow_origin, you should set it to my.frontend.domain.com. This will open your API for example for your AngularJS frontend. If you are building API as a service (open for everyone), than open to all origins "*".

CORS is not authorization. Treat it as firewall. Than you still need authorization (OAuth).

edited Apr 30, 2015 at 13:42

Peter Bailey

106k32 gold badges186 silver badges206 bronze badges

answered Apr 30, 2015 at 12:14

drymek

3351 silver badge5 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Symfony2 rest api security configuration (Trying to understand)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related