带有设计授权方的 EmberJS SimpleAuth 不发送令牌 header

Question

我不知道如何通过 ember-simple-auth-devise 授权方（版本 0.7.2）获取 ember-simple-auth 以将令牌 header 附加到我的后端请求。

这是我的 config/environment.js 的样子：

  var ENV = {
    modulePrefix: 'frontend-app',
    environment: environment,
    baseURL: '/',
    locationType: 'auto',
    EmberENV: {
      FEATURES: {}
    },

    APP: {},

    'simple-auth': {
      authenticationRoute: 'sign-in',
      authorizer: 'simple-auth-authorizer:devise'
    }
  };

  if (environment === 'development') {
    // ENV.APP.LOG_RESOLVER = true;
    // ENV.APP.LOG_ACTIVE_GENERATION = true;
    ENV.APP.LOG_TRANSITIONS = true;
    // ENV.APP.LOG_TRANSITIONS_INTERNAL = true;
    // ENV.APP.LOG_VIEW_LOOKUPS = true;

    ENV.contentSecurityPolicy = {
      'font-src': "'self' http://fonts.gstatic.com",
      'style-src': "'self' 'unsafe-inline' http://fonts.googleapis.com",
      'connect-src': "'self' http://localhost:3000",
    };

    ENV['simple-auth-devise'] = {
      serverTokenEndpoint: "//localhost:3000/users/sign_in"
    };

    ENV.apiHost = "http://localhost:3000";
  }

我能够使身份验证正常工作，我在我的应用程序中得到 session object。这是与 session 端点成功交换的 headers：

POST /users/sign_in HTTP/1.1
Host: localhost:3000
Connection: keep-alive
Content-Length: 63
Accept: application/json, text/javascript
Origin: http://localhost:4200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost:4200/sign-in
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8

然后服务器响应 session object:

{"user_token":"eo2xxzYsQ6UifMKvoLMF","user_id":3,"user_email":"snip@snip.com","user_first_name":"Xavier","user_last_name":"Lange"}

但是所有后续请求都没有设置 header:

GET /api/reports?user_id=3 HTTP/1.1
Host: localhost:3000
Connection: keep-alive
Cache-Control: max-age=0
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:4200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
Referer: http://localhost:4200/reports
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
If-None-Match: W/"8e1b98de900ac194a0bc3ef6e9dc7459"

我应该期待的地方

Authorization: Token token="<token>", email="<email>"

将在 header 秒内发送到后端。但这并没有发生。

Answer 1

问题已通过检查开发中的 crossOriginWhitelist 解决：

  if (environment === 'development') {
    // ENV.APP.LOG_RESOLVER = true;
    // ENV.APP.LOG_ACTIVE_GENERATION = true;
    ENV.APP.LOG_TRANSITIONS = true;
    // ENV.APP.LOG_TRANSITIONS_INTERNAL = true;
    // ENV.APP.LOG_VIEW_LOOKUPS = true;

    ENV.contentSecurityPolicy = {
      'font-src': "'self' http://fonts.gstatic.com",
      'style-src': "'self' 'unsafe-inline' http://fonts.googleapis.com",
      'connect-src': "'self' http://localhost:3000",
    };

    ENV['simple-auth']['crossOriginWhitelist'] = ['http://localhost:3000'];
    ENV['simple-auth-devise']['serverTokenEndpoint'] = "//localhost:3000/users/sign_in"

    ENV.apiHost = "http://localhost:3000";
  }

然后我不得不更改 simple-auth-devise 以使用 email 作为标识属性（rails 很难解析授权 header 与 authenticate_with_http_token:

  var ENV = {
    modulePrefix: 'my-app',
    environment: environment,
    baseURL: '/',
    locationType: 'auto',
    EmberENV: {
      FEATURES: {
        // Here you can enable experimental features on an ember canary build
        // e.g. 'with-controller': true
      }
    },

    APP: {
      // Here you can pass flags/options to your application instance
      // when it is created
    },

    'simple-auth': {
      authenticationRoute: 'sign-in',
      authorizer: 'simple-auth-authorizer:devise'
    },

    'simple-auth-devise': {
      identificationAttributeName: 'email'
    }
  };

我的 session 序列化程序必须与该属性名称同步：

class SessionsController < Devise::SessionsController
  skip_before_action :authenticate_user_from_token!, only: [:create]

  def create
    respond_to do |format|
      format.json do
        self.resource = warden.authenticate!(auth_options)
        sign_in(resource_name, resource)
        data = {
          token: self.resource.authentication_token,
          user_id: self.resource.id,
          email: self.resource.email,
          user_first_name: self.resource.first_name,
          user_last_name: self.resource.last_name
        }
        render json: data, status: 201
      end
    end
  end
end

带有设计授权方的 EmberJS SimpleAuth 不发送令牌 header

EmberJS simpleauth with devise authorizer not sending token header

ruby-on-rails

devise

ember.js

ember-cli

ember-simple-auth