Add simple tutorial for getting started with authentication

[joeytwiddle]

This tutorial is intended to make it easy for a developer to quickly get familiar with the basic code needed for authentication. From this point they can then build any authentication system they like.

Migrated from loopbackio/loopback.io#910

Fixes loopbackio/loopback.io#911

Checklist

• npm test passes on your machine

• Code conforms with the style guide

• Documentation in /docs/site was updated

• npm run verify:docs completed. Sorry, I didn't run this because I don't want to install Bundler.

👉 Check out how to submit a PR 👈

[dhmlau]

in https://github.com/joeytwiddle/lb-4-authentication-session-tokens-example/blob/first-steps/src/controllers/ping.controller.ts#L39, it doesn't have the & User portion. Do you mean just:

@inject(AuthenticationBindings.CURRENT_USER, { optional: true }) private user: UserProfile

[joeytwiddle]

The reason I put UserProfile & User in the tutorial is that we found it pretty helpful in our applications to pass the entire User model to the controllers. So I wanted to show readers that is an option available to them.

But the demo cannot do this because there is no User model or repository! That's why I just left it out of my own PingController.

My hope was that people doing the tutorial will delete the User if they don't have a collection, or import it if they do have a collection.

Resolution: I could drop back to just UserProfile and add a comment:

// If you decided earlier to pass the full User object to controllers, put `UserProfile & User` here

Does that sound ok?

(Done!)

[joeytwiddle]

Let's remove this comment altogether.

We are using this trick to pass the entire User model to controllers, but that's out of the scope of this tutorial.

[dhmlau]

Thanks @joeytwiddle again for your PR! Your tutorial is clearly written that I can easily follow along.

I think it has very good instructions in adding the basic authentication to a LB4 app. My only concern that about the "next step" section. I'm thinking that it might be a good transition to the JWT tutorial?

I'd like to get some thoughts from @emonddr and @jannyHou since they've developed this package and the related docs.

[joeytwiddle]

Thanks for trying it out @dhmlau.

My goal with this tutorial was to introduce the authentication basics for someone who might not want to use JWT. (Perhaps they want to integrate with their existing authentication system.)

But I can re-arrange that section to promote JWT at the top. Hopefully this will help developers make the right choice for them. (Done!)

[dhmlau]

@joeytwiddle, actually I was thinking to keep the tutorial to be only about basic authentication without JWT authentication. :) . It's because we have https://loopback.io/doc/en/lb4/Authentication-Tutorial.html for JWT already, so it would be good to keep them separate?

What I'm proposing is:

• there is no login method, just check with the authorization header if the endpoint is meant to be protected
• maybe remove the "Completing the session tokens system" section

What do you think?

[joeytwiddle]

OK I guess that makes sense. Just implement Basic authentication and nothing more.

But I'm not sure when I'll get around to changing it. If you don't want to wait, please feel free to modify this PR as desired.

(I believe loopback organisation will have push permissions to this branch.)

[joeytwiddle]

I see now that this upsets TypeScript. In our app we just @ts-ignore it!

Is there any nice way to do this?

(We like to pass the user directly to our controllers.)

[dhmlau]

I was half-way trying out your commented portion :)
I used the snippet below instead: (my User might be different than yours)

return {[securityId]: foundUser.email, id: foundUser.email}

[joeytwiddle]

Yeah that looks good. I should not be trying to return a User object in this tutorial.

---

Although for anyone interested, what we do is this:

    // Add an extra field to the user object, so we can pass the full User model to controllers
    // @ts-ignore
    user[securityId] = user.id;
    return user as (UserProfile & User);

[dhmlau]

@joeytwiddle , I can make my suggested changes to your branch. Will ask you to review when it's done. Thanks!

[bajtos]

@joeytwiddle @dhmlau what's the status of this pull request?

[dhmlau]

@bajtos, I'm working on a rework of the authentication tutorial with the content from @joeytwiddle here. Work-in-progress version is here: https://github.com/dhmlau/loopback4-authentication-app. Will try to work on it next week.

[deepakrkris]

by session tokens , do you mean, a client web session with cookies ?

[joeytwiddle]

@deepakrkris More or less.

My personal experience has been passing the tokens through the Authorization header.

We use Authorization: Basic to log in, then Authorization: Bearer for the rest of the session.

I think using cookies would be a fairly similar approach. (Log in to create a new cookie, after that use the cookie to authenticate.)

[agnes512]

@dhmlau @jannyHou is the Todo example JWT satisfied the requirement?

[jannyHou]

@agnes512 Yes todo-jwt is the new entry point of authentication tutorial. @joeytwiddle 's tutorial about basic authentication is also good, I am thinking of landing it as an auth tutorial for people to quickly get started with basic auth. They both help.

[dhmlau]

We just switch the contribution method from CLA to DCO, making your contribution easier in the future. Please sign the commits with DCO by amending your commit messages with -s flag and push the changes again. If you're using the command line, you can:

git commit --amend -s
git push --force-with-lease

Please refer to this docs page for details. Thanks!

[stale]

This pull request has been marked stale because it has not seen activity within two months. It will be closed within 14 days of being stale unless there is new activity.

[stale]

This pull request has been marked stale because it has not seen activity within two months. It will be closed within 14 days of being stale unless there is new activity.

[stale]

This pull request has been closed due to continued inactivity. If you are interested in finishing the proposed changes, then feel free to re-open this pull request or open a new one.