AuthController allows invalid credentials

[kiuka]

Hello,

I try to integrate your plugin into Lumen 5.2, it seems work fine, except it allows invalid credentials.

When I send a request to /auth/login with email "jaoisdjsaod@ajsiod.hu" and password "ajsdoijsa" it returns a valid token

{"success":{"message":"token_generated","token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImlzcyI6Imh0dHA6XC9cL3BsYW50bWFuYWdlci1hcGkuZGV2XC9hdXRoXC9sb2dpbiIsImlhdCI6MTQ2NDM1NTkzNiwiZXhwIjoxNDY0MzU5NTM2LCJuYmYiOjE0NjQzNTU5MzYsImp0aSI6ImI1YmY4OTNhOTUyZGQwMDZiZWIxODFmMTkyNGEwMTJjIn0.3PhVhypGwegsH_2yNTeTMvDRqQApnakd6zaWsRJEC8I"}}

---

I was trying to determinate the problem, and it seems the error is somewhere around ApiGuard and TokenGuard.

ApiGuard:

    public function __construct(UserProvider $provider, Request $request)
    {
        $this->request = $request;
        $this->provider = $provider;
        **$this->inputKey = app('config')->get('auth.guards.api.identifier');
        $this->storageKey = app('config')->get('auth.guards.api.password');**
    }

TokenGuard validate function convert credentials:

    public function validate(array $credentials = [])
    {
        $credentials = [$this->storageKey => $credentials[$this->inputKey]];

        if ($this->provider->retrieveByCredentials($credentials)) {
            return true;
        }

        return false;
    }

so the output of the above will be:

['password' => '[emailaddress that I send]']

thus credentials does not match anything in EloquentUserProvider, cause it filter items with key 'password':

    public function retrieveByCredentials(array $credentials)
    {
        if (empty($credentials)) {
            return;
        }

        // First we will add each credential element to the query as a where clause.
        // Then we can execute the query and, if we found a user, return it in a
        // Eloquent User "model" that will be utilized by the Guard instances.
        $query = $this->createModel()->newQuery();

        foreach ($credentials as $key => $value) {
            if (! Str::contains($key, 'password')) {
                $query->where($key, $value);
            }
        }

        return $query->first();
    }

Could you help me what am I missing?

[krisanalfa]

Hi, @kiuka. I updated the source code. Let me know if it works fine.

[kiuka]

It works fine now, thank you very much.