Missing authorization for DebugKit

[chrisch-hh]

I'm playing around with the Authorization middleware and followed the documentation. The authorization middleware seems to break the DebugKit plugin. After enabling the authorization middleware DebugKit throws a Authorization\Exception\AuthorizationRequiredException and says:

The request to /debug-kit/toolbar/7d4c0193-714d-4e4e-b48c-341e0f9ed99a did not apply any authorization checks.

So obviously the authorization is missing. How can I give DebugKit the needed authorizations or exclude it completely from the authorization? I guess there is an easy solution but I'm not so deep into the middleware/plugin topic.

[markstory]

What I've done in my applications is use an inline function middleware to disable authorization checks.

// In Application::middleware() after authorization has been added.

        if (Configure::read('debug')) {
            // Disable authz for debugkit
            $middleware->add(function ($req, $res, $next) {
                if ($req->getParam('plugin') === 'DebugKit') {
                    $req->getAttribute('authorization')->skipAuthorization();
                }
                return $next($req, $res);
            });
        }

This isn't something that ships with either plugin by default as we don't want to be presumptuous about disabling authorization for any part of an application. We could potentially add an opt-in flag to authorization allowing it to be skipped for a list of named plugins though. Do you think that would help your situation?

[chrisch-hh]

Thanks, that seems to work for me. I think an opt-in flag would be helpful. Also a hint in the quick start section of the authorization documentation would be helpful because I guess it's the starting point for most of the developers and most of them use the DebugKit plugin.

[farid-linein]

// In Application::middleware() after authorization has been added.

        if (Configure::read('debug')) {
            // Disable authz for debugkit
            $middleware->add(function ($req, $res, $next) {
                if ($req->getParam('plugin') === 'DebugKit') {
                    $req->getAttribute('authorization')->skipAuthorization();
                }
                return $next($req, $res);
            });
        }

@markstory
this solution doesn't work when using Request Authorization Middleware.
is there another solution that can be used to display the DebugKit ?

[markstory]

I don't use Request Authorization Middleware. Perhaps @burzum has a suggestion.

[farid-linein]

I'm playing around with the Authorization middleware and followed the documentation. The authorization middleware seems to break the DebugKit plugin. After enabling the authorization middleware DebugKit throws a Authorization\Exception\AuthorizationRequiredException and says:

The request to /debug-kit/toolbar/7d4c0193-714d-4e4e-b48c-341e0f9ed99a did not apply any authorization checks.

So obviously the authorization is missing. How can I give DebugKit the needed authorizations or exclude it completely from the authorization? I guess there is an easy solution but I'm not so deep into the middleware/plugin topic.

You can use 'Request Authorization Middleware'

RequestPolicy class implements RequestPolicyInterface
{
/ **
      * Method to check if the request can be accessed
      *
      * @param
      * \ Authorization \ IdentityInterface | null Identity
      * @param \ Cake \ Http \ ServerRequest $ request
      * Server Request
      * @return bool
      * /
     public canAccess function ($ identity, ServerRequest $ request)
     {

         / *
          * Debugkit bypass authorize
          * /
         if (($ request-> getParam ('plugin') === 'DebugKit')) {
             Return true;
         }

        / *
          * bypass other required functions such as pagesController
          * /
         if ($ request-> getParam ('controller') === 'Pages') {
             Return true;
         }

link https://github.com/cakephp/authorization/blob/master/docs/en/request-authorization-middleware.rst

I use this method, maybe it's not the right way but for me this works

[Erwane]

maybe we can check in the DebugKit/config/bootstrap if Authorization\Middleware\AuthorizationMiddleware is present in queue AND skip authorization at this moment ?

[angelxmoreno]

This is what I did and it would be very useful if theAuthorizationMiddleware itself had a whitelistCallback method similar to the CsrfProtectionMiddleware

public function middleware($middlewareQueue)
    {
        $AuthorizationMiddleware = new AuthorizationMiddleware($this);
        $middlewareQueue
           // other middleware but especially `RoutingMiddleware`
            ->add(function (ServerRequestInterface $request, ResponseInterface $response, callable $next) use ($AuthorizationMiddleware) {
                $params = $request->getAttribute('params');
                if ($params['plugin'] !== 'DebugKit') {
                    return $AuthorizationMiddleware($request, $response, $next);
                }

                return $next($request, $response);
            });

        return $middlewareQueue;
    }

[markstory]

Another option that can work if you use routing scopes is to attach AuthorizationMiddleware in a scope, and the include DebugKit's routes in a scope that doesn't have authorization loaded.

// in config/routes.php
$builder->registerMiddleware('authorization', new AuthorizationMiddleware($this));

$routes->scope('/', function ($builder) {  
  $builder->applyMiddleware('authorization');
  // Other routes.
});

// New scope, no middleware applied.
$routes->scope('/', function ($builder) {
  $builder->loadPlugin('DebugKit');
});

[dereuromark]

Many dont use scope and middleware combination.
I think we should at least add one way to the docs. :)

I like the idea of the whitelistCallback though.

[japita-se]

A clear doc about AAA in cakephp > 3.8 is a long way far...

[markstory]

@japita-se Both authentication and authorization have getting started tutorials. Are you looking for a tutorial on using them together? What is the third A for?

[groovenectar]

A clear doc about AAA in cakephp > 3.8 is a long way far...

Did you not see these?

https://book.cakephp.org/authentication/1/en/index.html
https://book.cakephp.org/authorization/1/en/index.html

[Erwane]

Why not just add a check in AuthorizationMiddleware like this ?

    try {
            $response = $handler->handle($request);

            if ($request->getParam('plugin') === 'DebugKit') {
                $service->skipAuthorization();
            }

i've a solution to disable from debugkit plugin but there is more code (see issue in debug_kit project cakephp/debug_kit#729)