Just a quick one to make people aware of some potentially useful things I’ve done as part of the day job.
Here is a wrapper around symfony routing that makes it behave, more or less, like Toro. This lets you create simple REST pages, which understand HTTP Verbs.
Additionally you can bind in understanding for access grants and bearer tokens.
We use this to build out a lot of our services at the day job, so hopefully it’ll be of some use to you.
Just a quick one, you’ve been coding up your REST api, and are trying to use a Bearer authorization token (as obtained from an OAuth2 handshake), and it’s just not working.
If you send your access token as a GET or POST value things work fine however.
You point your head at httpbin.org and to see what your client is sending, and low and behold, the bearer token is present and correct.
You scratch your head and dump the contents of $_SERVER to a log, and to your surprise, nothing. No Authorization header is present!
To save you many a frustrating hour, here’s the answer. Turns out that Apache will strip any authorisation header it doesn’t recognise, which is basically anything that’s not basic auth.
So, you need to put it back in yourself. Do so by putting the following into your .htaccess
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
As part of (one of) my day jobs, I have had to yet again bash together a set of REST APIs. This is so we can start wiring up some proper micro services AWS style scalable architecture into the monolithic beast that is the current incarnation of the software I’m working on.
Anyway, here are a few gotchas for this if you intend to start using proper REST style HTTP verbs (PUT/PATCH/DELETE), rather than doing everything via GET and POST like most everyone.
If you’re familiar with the standard $_POST mechanism to access passed variables, you’ll be disappointed that PHP doesn’t by default provide a nice way of access these for PUT and PATCH.
So, you’re going to have to extract them yourself. Not overly tricky, but irritating:
So, for example:
parse_str(file_get_contents('php://input'), $patch);
if (is_array($patch)) {
$this->data = array_merge($this->data, $patch);
}If you find that your APIs work fine on your local machine but break when deployed, you might want to check your server configuration.
It is quite common for web servers (especially on shared hosts) to block access to HTTP verbs other than most common GET and POST. Modsecurity’s default config definitely blocks these methods.
You should also check that any proxies or load balancers that you have in front of your REST endpoint. These may need some configuration tweaks as well.
Hopefully this will save you some time and frustration!