yemiwebby/ci-secure-api

CodeIgniter 4 Application Starter

What is CodeIgniter?

CodeIgniter is a PHP full-stack web framework that is light, fast, flexible, and secure. More information can be found at the official site.

This repository holds a composer-installable app starter. It has been built from the development repository.

More information about the plans for version 4 can be found in the announcement on the forums.

The user guide corresponding to this version of the framework can be found here.

Installation & updates

composer create-project codeigniter4/appstarter then composer update whenever there is a new release of the framework.

When updating, check the release notes to see if there are any changes you might need to apply to your app folder. The affected files can be copied or merged from vendor/codeigniter4/framework/app.

Setup

Copy env to .env and tailor for your app, specifically the baseURL and any database settings.

Important Change with index.php

index.php is no longer in the root of the project! It has been moved inside the public folder, for better security and separation of components.

This means that you should configure your web server to "point" to your project's public folder, and not to the project root. A better practice would be to configure a virtual host to point there. A poor practice would be to point your web server to the project root and expect to enter public/..., as the rest of your logic and the framework are exposed.

Please read the user guide for a better explanation of how CI4 works! The user guide updating and deployment is a bit awkward at the moment, but we are working on it!

Repository Management

We use Github issues, in our main repository, to track BUGS and to track approved DEVELOPMENT work packages. We use our forum to provide SUPPORT and to discuss FEATURE REQUESTS.

This repository is a "distribution" one, built by our release preparation script. Problems with it can be raised on our forum, or as issues in the main repository.

Server Requirements

PHP version 7.2 or higher is required, with the following extensions installed:

• intl
• libcurl if you plan to use the HTTP\CURLRequest library

Additionally, make sure that the following extensions are enabled in your PHP:

• json (enabled by default - don't turn it off)
• mbstring
• mysqlnd
• xml (enabled by default - don't turn it off)

ci-secure-api's Issues

User Profile js File error

Refernce: https://www.twilio.com/blog/build-single-page-application-php-codeigniter-react

When I am going with webpack bind the code, then its shows Error in Unexpected token, expected ", user/profile.js

Please do the needful

weak implementation of validation

this repository overcomplicated the mechanish.. all the real validation is don using helper input check event real class check over model.. this is done in the line

ci-secure-api/app/Controllers/Auth.php

Line 53 in 85aa0da

'password' => 'required|min_length[8]|max_length[255]|validateUser[email, password]'

using the custom user rule for the password input.. a weak way to implement the check..

ci-secure-api/app/Validation/UserRules.php

Line 10 in 85aa0da

public function validateUser(string $str, string $fields, array $data): bool

so JWT really does not handle the check and only returns a key that can be hacked

JWT_TIME_TO_LIVE is seconds not milliseconds

#JWT_TIME_TO_LIVE indicates the validity period of a signed JWT (in milliseconds)
#JWT_TIME_TO_LIVE=3600

In the env file the comment shows as above. But the JWT_TIME_TO_LIVE value is using seconds not milliseconds.

JWT issue

I need to replace jwt_helper.php with this:

use App\Models\UserModel;
use Config\Services;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

function getJWTFromRequest($authenticationHeader): string
{
if (is_null($authenticationHeader)) { //JWT is absent
throw new Exception('Missing or invalid JWT in request');
}
//JWT is sent from client in the format Bearer XXXXXXXXX
return explode(' ', $authenticationHeader)[1];
}

function validateJWTFromRequest(string $encodedToken)
{
$key = Services::getSecretKey();
$decodedToken = JWT::decode($encodedToken, new Key($key, 'HS256'));
$userModel = new UserModel();
$userModel->findUserByEmailAddress($decodedToken->email);
}

function getSignedJWTForUser(string $email)
{
$issuedAtTime = time();
$tokenTimeToLive = getenv('JWT_TIME_TO_LIVE');
$tokenExpiration = $issuedAtTime + $tokenTimeToLive;
$payload = [
'email' => $email,
'iat' => $issuedAtTime,
'exp' => $tokenExpiration,
];

$jwt = JWT::encode($payload, Services::getSecretKey(), 'HS256'); return $jwt;
}

React Not Working

Hi,

Thank you for your codes

I tried to creat this ci-secure-api plus react as you wrote on Twilio Blog.

I can assomplish the build by executing npx webpack and run with php spark serve

But, unfortunately, It appears blank from the beginning.

After some moment, I found that the problem is on following picture.

It need to be unactivated so it will appears login/register page.

However, after I registered, it will go to blank page again.

Please suggest

How to logout?

hi,
Thank you for your codes,

how to logout in this project?

thanks

Como usar CI-SECURE-API em hospedagem web compartilhada (CPanel)

Amigo, existe alguma configuração para fazer rodar essa API em hospedagem web compartilhada?

IncomingRequest instance exception

Hi I have this exception in Auth.php file
Argument 1 passed to App\Controllers\BaseController::getRequestInput() must be an instance of App\Controllers\IncomingRequest, instance of CodeIgniter\HTTP\IncomingRequest given

whene calling this $input = $this->getRequestInput($myRequest);