spieleprogrammierer.de - Forum und Wiki zur Spieleprogrammierung und Spieleentwicklung

Quellcode

    app.use(lusca({
      csrf: {
        angular: true
      },
      xframe: 'SAMEORIGIN',
      hsts: {
        maxAge: 31536000, //1 year, in seconds
        includeSubDomains: true,
        preload: true
      },
      xssProtection: true
    }));

Quellcode

@app.route("/test")
def test_login():
    client = requests.session()
    response = client.get('http://localhost:3000/login/')
    csrftoken = client.cookies['XSRF-TOKEN']
    login_data = {"username":'test', "password":'test', "X-XSRF-TOKEN":csrftoken}
    url = 'http://localhost:3000/api/auth/local'
    header = {"X-XSRF-TOKEN":csrftoken, "referrer":'http://localhost:3000/login/'}
    cookie = {"XSRF-TOKEN":csrftoken}
    response = client.post(url, data=login_data, headers=header, cookies=cookie)
    print(response)
    return (response.text, response.status_code)

Quellcode

<div class="container">
  <div class="row">
    <div class="col-sm-12">
      <h1>Login</h1>
      <!--<p>Default account is <code>test@example.com</code> / <code>test</code></p>
     <p>Admin account is <code>admin@example.com</code> / <code>admin</code></p>-->
    </div>
    <div class="col-sm-12">
      <form class="form" name="form" ng-submit="vm.login(form)" novalidate>
 
        <div class="form-group">
          <label>Email</label>
 
          <input type="email" name="email" class="form-control" ng-model="vm.user.email" required>
        </div>
 
        <div class="form-group">
          <label>Password</label>
 
          <input type="password" name="password" class="form-control" ng-model="vm.user.password" required>
        </div>
 
        <div class="form-group has-error">
          <p class="help-block" ng-show="form.email.$error.required && form.password.$error.required && vm.submitted">
             Please enter your email and password.
          </p>
          <p class="help-block" ng-show="form.email.$error.email && vm.submitted">
             Please enter a valid email.
          </p>
 
          <p class="help-block">{{ vm.errors.login }}</p>
        </div>
 
        <div>
          <button class="btn btn-inverse btn-lg btn-login" type="submit">
            Login
          </button>
          <a class="btn btn-default btn-lg btn-register" ui-sref="signup">
            Register
          </a>
        </div>
 
      </form>
    </div>
  </div>
  <hr>
</div>

Quellcode

'use strict';
// @flow
interface User {
  name: string;
  email: string;
  password: string;
}
 
export default class LoginController {
  user: User = {
    name: '',
    email: '',
    password: ''
  };
  errors = {login: undefined};
  submitted = false;
  Auth;
  $state;
 
  /*@ngInject*/
  constructor(Auth, $state) {
    this.Auth = Auth;
    this.$state = $state;
  }
 
  login(form) {
    this.submitted = true;
 
    if (form.$valid) {
      this.Auth.login({
        email: this.user.email,
        password: this.user.password
      })
      .then(() => {
        // Logged in, redirect to home
        this.$state.go('main');
      })
      .catch(err => {
        this.errors.login = err.message;
      });
    }
  }
}

Quellcode

'use strict';
// @flow
class _User {
  _id: string = '';
  name: string = '';
  email: string = '';
  role: string = '';
  $promise = undefined;
}
 
export function AuthService($location, $http, $cookies, $q, appConfig, Util, User) {
  'ngInject';
  var safeCb = Util.safeCb;
  var currentUser: _User = new _User();
  var userRoles = appConfig.userRoles || [];
  /**
   * Check if userRole is >= role
   * @param {String} userRole - role of current user
   * @param {String} role - role to check against
   */
  var hasRole = function(userRole, role) {
    return userRoles.indexOf(userRole) >= userRoles.indexOf(role);
  };
 
  if($cookies.get('token') && $location.path() !== '/logout') {
    currentUser = User.get();
  }
 
  var Auth = {
    /**
     * Authenticate user and save token
     *
     * @param  {Object}   user     - login info
     * @param  {Function} callback - function(error, user)
     * @return {Promise}
     */
    login({email, password}, callback?: Function) {
      return $http.post('/auth/local', { email, password })
        .then(res => {
          $cookies.put('token', res.data.token);
          currentUser = User.get();
          return currentUser.$promise;
        })
        .then(user => {
          safeCb(callback)(null, user);
          return user;
        })
        .catch(err => {
          Auth.logout();
          safeCb(callback)(err.data);
          return $q.reject(err.data);
        });
    },
 
    /**
     * Delete access token and user info
     */
    logout() {
      $cookies.remove('token');
      currentUser = new _User();
    },
 
    /**
     * Create a new user
     *
     * @param  {Object}   user     - user info
     * @param  {Function} callback - function(error, user)
     * @return {Promise}
     */
    createUser(user, callback?: Function) {
      return User.save(user,
        function(data) {
          $cookies.put('token', data.token);
          currentUser = User.get();
          return safeCb(callback)(null, user);
        },
        function(err) {
          Auth.logout();
          return safeCb(callback)(err);
        }).$promise;
    },
 
    /**
     * Change password
     *
     * @param  {String}   oldPassword
     * @param  {String}   newPassword
     * @param  {Function} callback    - function(error, user)
     * @return {Promise}
     */
    changePassword(oldPassword, newPassword, callback?: Function) {
      return User.changePassword({ id: currentUser._id }, { oldPassword, newPassword }, function() {
        return safeCb(callback)(null);
      }, function(err) {
        return safeCb(callback)(err);
      }).$promise;
    },
 
    /**
     * Gets all available info on a user
     *
     * @param  {Function} [callback] - function(user)
     * @return {Promise}
     */
    getCurrentUser(callback?: Function) {
      var value = _.get(currentUser, '$promise')
        ? currentUser.$promise
        : currentUser;
 
      return $q.when(value)
        .then(user => {
          safeCb(callback)(user);
          return user;
        }, () => {
          safeCb(callback)({});
          return {};
        });
    },
 
    /**
     * Gets all available info on a user
     *
     * @return {Object}
     */
    getCurrentUserSync() {
      return currentUser;
    },
 
    /**
     * Check if a user is logged in
     *
     * @param  {Function} [callback] - function(is)
     * @return {Promise}
     */
    isLoggedIn(callback?: Function) {
      return Auth.getCurrentUser(undefined)
        .then(user => {
          let is = _.get(user, 'role');
 
          safeCb(callback)(is);
          return is;
        });
    },
 
    /**
     * Check if a user is logged in
     *
     * @return {Bool}
     */
    isLoggedInSync() {
      return !!_.get(currentUser, 'role');
    },
 
     /**
      * Check if a user has a specified role or higher
      *
      * @param  {String}     role     - the role to check against
      * @param  {Function} [callback] - function(has)
      * @return {Promise}
      */
    hasRole(role, callback?: Function) {
      return Auth.getCurrentUser(undefined)
        .then(user => {
          let has = hasRole(_.get(user, 'role'), role);
 
          safeCb(callback)(has);
          return has;
        });
    },
 
    /**
      * Check if a user has a specified role or higher
      *
      * @param  {String} role - the role to check against
      * @return {Bool}
      */
    hasRoleSync(role) {
      return hasRole(_.get(currentUser, 'role'), role);
    },
 
     /**
      * Check if a user is an admin
      *   (synchronous|asynchronous)
      *
      * @param  {Function|*} callback - optional, function(is)
      * @return {Bool|Promise}
      */
    isAdmin() {
      return Auth.hasRole
        .apply(Auth, [].concat.apply(['admin'], arguments));
    },
 
     /**
      * Check if a user is an admin
      *
      * @return {Bool}
      */
    isAdminSync() {
      return Auth.hasRoleSync('admin');
    },
 
    /**
     * Get auth token
     *
     * @return {String} - a token string used for authenticating
     */
    getToken() {
      return $cookies.get('token');
    }
  };
 
  return Auth;
}