There is currently no difference between an "access denied" and "token not valid" response, both return a HTTP status code 403. This is problematic because now it's not known wether you don't have access to the endpoint or your auth token is not valid. Both very different cases. This is not a problem when the user never regenerates it auth key, but the problem arrises when the user has generated a new auth key and is stil using the old auth key.
An example of why this is useful (we are using this in our own decoupled application):
Return a HTTP status code 401 when the token is not valid.
The code below is working for us. I have replaced the "Return NULL;" with a 401 exception. I borrowed this from the Simple OAuth module, that module also does it this way.
public function authenticate(Request $request) {
// Get the provided key.
if ($key = $this->keyAuth->getKey($request)) {
// Find the linked user.
if ($user = $this->keyAuth->getUserByKey($key)) {
// Check access.
if ($this->keyAuth->access($user)) {
// Return the user.
return $user;
}
}
}
throw new HttpException(
401,
'Client authentication failed',
);
}Needs review
2.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I believe the true solution to this situation is two fold.
Symfony\Component\HttpKernel\Exception\UnauthorizedHttpExceptionFor example:
if (!$key_auth instanceof UserInterface) {
throw new UnauthorizedHttpException('Bearer realm(**YOUR-DOMAIN**)', 'Invalid consumer API key.');
}