CODEWITHSUNDEEP
apisecurityrestsymfonyoauth-2.0
Noquepoaqui
Noquepoaqui

Reputation: 395

symfony2 rest api with separated client and end user security

I'm building a REST API on symfony2 and I'm not sure what would be the best way to manage different security levels.

For example, api/v1/philosophies would list all the phylosophies to an authenticated client. Unregistered end users could see the list: 'idealism, realism, existencialism, ...'. But end users would need to be authorized (registered and logged) to access their favorite phylosophies through api/v1/user/{userID}/favorites.

I've been reading and testing stuff with FOSUserBundle, FOSRestBundle and FOSOAuthServerBundle but all the information i find has the users always logged in order to get the token and the whole api is protected both by client and by users.

Any idea?

Some light?

please?

Upvotes: 0

Views: 504

Answers (1)

Sehael
Sehael

Reputation: 3736

FOSRest and FOSAuth will work fine for what you need, it just looks like you will need to change the way your access is defined in security.yml. The only reason you always have to be logged in to access resources, is because the resources are protected. If you have a resource that you want to allow anonymous access to, then make that entry in security.yml, something like this:

security:
    access_control:
        - { path: ^/api/v1/pilosophies$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/v1, roles: IS_AUTHENTICATED_FULLY }

This would make /api/v1/pilosophies accessible without logging in, but all other resources would still be protected. you can read more about this in the docs Securing specific url patterns

In the end, you are the one that decides what resources are protected or not. FOSOAuth has nothing to do with that decision.

Upvotes: 1

Related Questions