Codi generat
```php El codi que es genera es correspon a un controlador de tipus ****ResourceController**** amb les funcions: - ****index****: Obtenir tots els elements - ****show (id)****: Obtenir un element concret - ****new:**** Crear un nou element buit - ****create:**** Afegir un nou element - ****edit (id):**** Obtenir un element per editar-lo - ****update (id):**** Desar un element despres editar-lo - ****delete (id):**** Eliminar un elementExemple
```php /** * Return an array of resource objects, themselves in array format * * @return mixed */ public function index() { $model = new NewsModel(); $response = [ 'status' => 200, "error" => false, 'messages' => 'News list', 'data' => $model->findAll() ]; return $this->respond($response); } /** * Return the properties of a resource object * * @return mixed */ public function show($id = null) { $model = new NewsModel(); $data = $model->find($id); if (!empty($data)) { $response = [ 'status' => 200, "error" => false, 'messages' => 'Single news data', 'data' => $data ]; } else { $response = [ 'status' => 500, "error" => true, 'messages' => 'No news found', 'data' => [] ]; } return $this->respond($response); } /** * Create a new resource object, from "posted" parameters * * @return mixed */ public function create() { $rules = [ 'title' => 'required|min_length[3]|max_length[128]', 'body' => 'required', ]; $messages = [ "body" => [ "required" => "Cos de noticia necessari" ], "title" => [ "required" => "Titol noticia necessari", "min_length" => "Titol massa curt", "max_length" => "Titol massa llarg" ], ]; if (!$this->validate($rules, $messages)) { $response = [ 'status' => 500, 'error' => true, 'message' => $this->validator->getErrors(), 'data' => [] ]; } else { $model = new NewsModel(); $title = $this->request->getVar('title'); $slug = url_title($title); $body = $this->request->getVar('body'); $newId = $model->addNoticia($title, $slug, $body); $response = [ 'status' => 200, 'error' => false, 'message' => 'News added successfully', 'data' => [ 'id' => $newId, 'title' => $title, 'slug' => $slug, 'body' => $body ] ]; } return $this->respondCreated($response); } /** * Add or update a model resource, from "posted" properties * * @return mixed */ public function update($id = null) { $rules = [ 'title' => 'required|min_length[3]|max_length[128]', 'body' => 'required', ]; $messages = [ "body" => [ "required" => "Cos de noticia necessari" ], "title" => [ "required" => "Titol noticia necessari", "min_length" => "Titol massa curt", "max_length" => "Titol massa llarg" ], ]; if (!$this->validate($rules, $messages)) { $response = [ 'status' => 500, 'error' => true, 'message' => $this->validator->getErrors(), 'data' => [] ]; } else { $model = new NewsModel(); if ($model->find($id)) { $title = $this->request->getVar('title'); $slug = url_title($title); $body = $this->request->getVar('body'); $model->updateNoticia($id, $title, $slug, $body); $response = [ 'status' => 200, 'error' => false, 'message' => 'News updated successfully', 'data' => [ 'id' => $id, 'title' => $title, 'slug' => $slug, 'body' => $body ] ]; } else { $response = [ 'status' => 500, "error" => true, 'messages' => 'No news found', 'data' => [] ]; } } return $this->respondUpdated($response); } /** * Delete the designated resource object from the model * * @return mixed */ public function delete($id = null) { $model = new NewsModel(); $data = $model->find($id); if (!empty($data)) { $model->where(['id' => $id])->delete(); $response = [ 'status' => 200, "error" => false, 'messages' => 'News deleted successfully', 'data' => [] ]; } else { $response = [ 'status' => 500, "error" => true, 'messages' => 'No news found', 'data' => [] ]; } return $this->respondDeleted($response); } ```https://codeigniter.com/user\_guide/libraries/throttler.html
# Securització APIs # Mecanismes de securització ### Autenticació bàsica És la forma més bàsica d'autenticació disponible per les aplicacions web, es va definir en la primera especificació del protocol HTTP. Sense ser un mecanisme elegant acompleix la seva funció. Aquest mecanisme no requereix la utilització de cookies, ni identificadors de sessió, ni pàgines de login. Aquest procés fou dissenyat amb la finalitat que el navegador web pugui aportar les credencials basades en l'usuari i la contrasenya i que així li permetin autenticar-se davant d'un servei. Les dades s'envien codificades únicament en Base64. Aquest mecanisme és completament reversible i permet obtenir les dades que s'hi codifiquen sense cap dificultat.
[Cyberchef. Base64](https://cyberchef.org/#recipe=To_Base64('A-Za-z0-9%2B/%3D')&input=aG9sYSBtb24 "Cyberchef. Base64")
Com funciona aquest protocol Quan el servidor vol que el client s'autentiqui envia dins la capçalera de resposta a la petició el camp ****WWW-Authenticate**** per una autenticació bàsica. ``` WWW-Authenticate: Basic realm="nmrs_m7VKmomQ2YM3:" ``` El client en el moment de rebre-ho, demana a l'usuari les credencials sol·licitades, per a construir la capçalera d'autorització que és una cadena del tipus "usuari:contrasenya", la cadena de caràcters resultant es codifica en RFC2045-MIME de Base64 sense la limitació de 76 caràcters que imposa la RFC. D'aquesta forma quedaria una cadena d'autenticació com la següent: ``` Authorization: Basic YWRtaW5pc3RyYWRvcjoxMjM0 ``` Si utilitzem [Cyberchef ](https://cyberchef.org/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=WVdSdGFXNXBjM1J5WVdSdmNqb3hNak0w "Decodificació del usuari i password")podem obtenir usuari i password fàcilment[https://es.wikipedia.org/wiki/Autenticación\_de\_acceso\_bàsica](https://es.wikipedia.org/wiki/Autenticaci%C3%B3n_de_acceso_b%C3%A0sica "Wiki autenticació bàsica")
### Autenticació del portador L'autenticació del portador consisteix en la comunicació mitjançant un token que s'envia en cada crida. Aquest element permet verificar la identitat o el rol de l'usuari a la part client. L'usuari envia el nom d'usuari i la seva contrasenya i el servidor després de verificar-ho li retorna un token. A partir d'aquell moment aquest token és l'element que envia a cada petició que fa el client.
| ****Capçalera**** | { "alg": "HS256", "typ": "JWT" } | Identifica l'algorisme amb què ha estat generada la signatura HS256 indica que aquest testimoni és signat usant HMAC-SHA256. El més típic és usar els algorismes HMAC amb SHA-256 (HS256) i Signatura RSA amb SHA-256 (RS256). JWA (JSON Web Algorithms) {{RFC|7518}} n'introdueix més tant per autenticació com xifrat. |
| ****Contingut**** | { "usuari": "admin", "iat": 1422779638 } | Conté les informacions que el client presenta. L'especificació JWT defineix set camps estàndards que acostumen a ser trobats aquí. També n'hi ha de personalitzats, segons quin sigui el propòsit del testimoni. En aquest exemple hi ha un clam estàndard, Issued At Time (iat) i un de personalitzat (identificació). |
| ****Signatura**** | HMAC\_SHA256( secret, base64urlEncoding(capçalera) + '.' + base64urlEncoding(cos) ) | Valida el testimoni de forma segura. El càlcul consisteix a codificar la capçalera i el contingut, usant codificació RFC 4648 Base64url, i concatenant-los amb un punt al mig. El resultat és xifrat segons indica la capçalera. El Base64url Encoding és similar a Base64, però usa diferents caràcters no alfanumèrics i omet caràcters de completat (padding). |
App\\Config\\Apijwt.php
```php /** * tokenSecret * Defines key to sign digitally the token JWT. * To generate in hex2bin use: * php spark key:generate --show * To generate in base64 use: * php spark key:generate --show --prefix base64 * * You must store only the key, without algorithm prefix * * @var string *********************************************************** * * hash * Defines hash used to sign JWT token. The signing algorithm (alg field) * Supported algorithms are 'ES384','ES256', 'HS256', 'HS384', * 'HS512', 'RS256', 'RS384', and 'RS512' * * @var string *********************************************************** * * authTimeout * Defines timeout for token JWT, exp field into token JWT * Set null to disable timeout * * @var int *********************************************************** * * issuer * Issuer of the JWT * Set null to ignore iss field from JWT token * * @var string *********************************************************** * * audience * Audience of the JWT * Set null to ignore aud field from JWT token * * @var string *********************************************************** * * subject * Subject of the JWT * Set null to ignore sub field from JWT token * * @var string *********************************************************** * * autoRenew * Renew automatically JWT token every request * * @var bool *********************************************************** * * oneTimeToken * JWT Token can be used only one time, toherwise is revoked * * @var bool *********************************************************** */ public $policyName = "default"; // Defines default policy name, to use by Library/Filter public $default = [ 'tokenSecret' => 'b952674c72eff0e5e482b7525cde57a1fcdddc486a89658fd8985169cda341e9', //hex2bin. 'hash' => "HS256", 'authTimeout' => 30 * MINUTE, 'issuer' => "daw-company", 'audience' => "daw-company.user-db", 'subject' => "secure.jwt.v1.daw", 'autoRenew' => true, 'oneTimeToken' => true, 'renewTokenField' => 'refreshToken', 'includePolicy' => true, ]; public $test = [ 'tokenSecret' => 'b952674c72eff0e5e482b7525cde57a1fcdddc486a89658fd8985169cda341e9', //hex2bin. 'hash' => "HS256", 'authTimeout' => 24 * HOUR, 'issuer' => "test-company", 'audience' => "test-company.user-db", 'subject' => "secure.jwt.v1.test", 'autoRenew' => false, 'oneTimeToken' => false, 'renewTokenField' => 'refreshToken', 'includePolicy' => true, ]; public function __construct($policy = null) { parent::__construct(); if ($policy != null) $this->policyName = $policy; } /** * Returns deafult configuration or configuration group * * @param mixed $groupName Config groupname to get * @return object */ public function config($policy = null) { if ($policy == null) $policy = $this->policyName; $props = get_object_vars($this); if (isset($props[$policy]) && is_array($props[$policy])) { $props[$policy]["policy"] = $policy; return (object) $props[$policy]; } else { $props[$this->policyName]["policy"] = $this->policyName; return (object) $props[$this->policyName]; } } ```App\\Database\\Migrations\\AddRevokeTokensTable.php
```php public function up() { $this->forge->addField([ 'tokenid' => [ 'type' => 'VARCHAR', 'constraint' => '36', 'null' => false, ], 'subject' => [ 'type' => 'VARCHAR', 'constraint' => '128', 'null' => false, ], 'expiration' => [ 'type' => 'INT', 'constraint' => 11, 'null' => false, ], ]); $this->forge->addPrimaryKey(['tokenid', 'subject']); $this->forge->createTable('tokens'); } public function down() { $this->forge->dropTable('tokens'); } ```App\\Models\\TokensModel.php
```php protected $DBGroup = 'default'; protected $table = 'tokens'; protected $primaryKey = ['tokenid', 'subject']; protected $useAutoIncrement = true; protected $insertID = 0; protected $returnType = 'array'; protected $useSoftDeletes = false; protected $protectFields = true; protected $allowedFields = ['tokenid', 'subject', 'expiration']; // Dates protected $useTimestamps = false; protected $dateFormat = 'datetime'; protected $createdField = 'created_at'; protected $updatedField = 'updated_at'; protected $deletedField = 'deleted_at'; // Validation protected $validationRules = []; protected $validationMessages = []; protected $skipValidation = false; protected $cleanValidationRules = true; // Callbacks protected $allowCallbacks = true; protected $beforeInsert = []; protected $afterInsert = []; protected $beforeUpdate = []; protected $afterUpdate = []; protected $beforeFind = []; protected $afterFind = []; protected $beforeDelete = []; protected $afterDelete = []; public function get($token_data) { $data = array( 'tokenid' => $token_data->jti, 'subject' => $token_data->sub??'subject.not.defined' ); return $this->where($data)->first(); } public function revoked($token_data) { return $this->get($token_data) != null; } public function revoke($token_data) { $data = array( 'tokenid' => $token_data->jti, 'subject' => $token_data->sub??'subject.not.defined', 'expiration' => $token_data->exp ); return $this->insert($data); } public function purge($time=null) { if ($time===null) $time=time(); $data = array('expiration <=' => $time); $query = $this->where($data)->delete(); return $this->affectedRows(); } ```App\\Helpers\\jwt\_helper.php
```php string, "data" => object] */ if (!function_exists('getToken')) { function getToken($cfgAPI, $request) { $header = $request->header("Authorization"); $token = null; if (!empty($header)) { if (preg_match('/Bearer\s(\S+)/', $header, $matches)) { $token = $matches[1]; } } $token_data = JWT::decode($token, new Key($cfgAPI->tokenSecret, $cfgAPI->hash)); $data = [ "encoded" => $token, "data" => $token_data ]; return $data; } } /** * renewTokenJWT * This function renews JWT token, with payload from a previous JWT. The * function renews jti (json token id), iat (issued at) and nbf (not before) * * If an error occurs on encoding, it throws a JWT Exception * * @param mixed $cfgAPI Config policy object * @param mixed $token_raw Token payload object * @return string (token) */ if (!function_exists('renewTokenJWT')) { function renewTokenJWT($cfgAPI, $token_raw) { $iat = time(); // current timestamp value if (isset($cfgAPI->authTimeout) && $cfgAPI->authTimeout != null) $token_raw->exp = $iat + $cfgAPI->authTimeout; $token_raw->iat = $iat; $token_raw->nbf = $iat; $token_raw->jti = App\Libraries\UUID::v4(); $newtoken = JWT::encode((array)$token_raw, $cfgAPI->tokenSecret, $cfgAPI->hash); return $newtoken; } } /** * newTokenJWT * This function generates a new JWT token, it takes info from token policy * defined on config file. Adds payload and config items * * @param mixed $cfgAPI Config policy object * @param mixed $data Payload data, to add to JWT * @return string Token generated */ if (!function_exists('newTokenJWT')) { function newTokenJWT($cfgAPI, $data) { $iat = time(); // current timestamp value $payload = array(); if (isset($cfgAPI->authTimeout) && $cfgAPI->authTimeout != null) $payload["exp"] = $iat + $cfgAPI->authTimeout; if (isset($cfgAPI->issuer) && $cfgAPI->issuer != null) $payload["iss"] = $cfgAPI->issuer; if (isset($cfgAPI->audience) && $cfgAPI->audience != null) $payload["aud"] = $cfgAPI->audience; if (isset($cfgAPI->subject) && $cfgAPI->subject != null) $payload["sub"] = $cfgAPI->subject; $payload = array_merge( $payload, array( "nbf" => $iat, "iat" => $iat, // Issued at "jti" => App\Libraries\UUID::v4(), // Json Token Id ), (array)$data ); $token = JWT::encode($payload, $cfgAPI->tokenSecret, $cfgAPI->hash); return $token; } } ```App\\Filters\\JWTFilter.php
```php header("Authorization"); $token = null; // extract the token from the header if (!empty($header)) { if (preg_match('/Bearer\s(\S+)/', $header, $matches)) { $token = $matches[1]; } } // check if token is null or empty if (is_null($token) || empty($token)) { $response = service('response'); $response->setBody('Access denied. Token required'); $response->setStatusCode(401); return $response; } try { $token_data = JWT::decode($token, new Key($cfgAPI->config()->tokenSecret, $cfgAPI->config()->hash)); // check if token is defined with another policy and is not a valid token if (($token_data->sub ?? 'undefined') != ($cfgAPI->config()->subject ?? 'undefined') || ($token_data->aud ?? 'undefined') != ($cfgAPI->config()->audience ?? 'undefined') || ($token_data->iss ?? 'undefined') != ($cfgAPI->config()->issuer ?? 'undefined') ) { $response = service('response'); $response->setBody('Access denied. Wrong token params'); $response->setStatusCode(401); return $response; } // check if token is revoked if ($model->revoked($token_data)) { $response = service('response'); $response->setBody('Access denied. Token revoked'); $response->setStatusCode(401); return $response; } // if oneTimeToken is enabled, revoke current token if ($cfgAPI->config()->oneTimeToken) { $model->revoke($token_data); } // store token data into request header to controller access $request->setHeader("token-data", json_encode($token_data)); $request->setHeader("token-config", json_encode($cfgAPI->config())); $request->setHeader("jwt-policy", $cfgAPI->policyName); } catch (\Exception $ex) { $response = service('response'); $response->setBody('Access denied. ' . $ex->getMessage()); $response->setStatusCode(401); return $response; } finally { // clear expired tokens in revoked tokens table $model->purge(); } } /** * Allows After filters to inspect and modify the response * object as needed. This method does not allow any way * to stop execution of other after filters, short of * throwing an Exception or Error. * * @param RequestInterface $request * @param ResponseInterface $response * @param array|null $arguments * * @return mixed * * @link https://docs.microsoft.com/en-us/machine-learning-server/operationalize/how-to-manage-access-tokens */ public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) { // ADD fields to api response, ONLY for StatusCode OK-200/CREATED-201/ACCEPTED-202 if ( $response->getStatusCode() == \CodeIgniter\HTTP\Response::HTTP_OK || $response->getStatusCode() == \CodeIgniter\HTTP\Response::HTTP_CREATED || $response->getStatusCode() == \CodeIgniter\HTTP\Response::HTTP_ACCEPTED ) { helper("jwt"); if (isset($arguments)) $cfgAPI = new \Config\APIJwt($arguments[0]); else $cfgAPI = new \Config\APIJwt(); try { $values = json_decode($response->getBody()); //check if $response->getBody() is a json string if (json_last_error() == JSON_ERROR_NONE) { if ($cfgAPI->config()->oneTimeToken && $cfgAPI->config()->autoRenew) { $token_data = json_decode($request->header("token-data")->getValue()); $newToken = renewTokenJWT($cfgAPI->config(), $token_data); $renewTokenField = $cfgAPI->config()->renewTokenField; $values->$renewTokenField = $newToken; } if ($cfgAPI->config()->includePolicy) $values->policy = $cfgAPI->policyName; } } catch (\Exception $ex) { $response = service('response'); $response->setBody('Access denied. After. ' . $ex->getMessage()); $response->setStatusCode(401); } finally { if ($values !== null) $response->setBody(json_encode($values)); } } } } ```App\\Config\\Filter
[](https://siensis.com/books/uploads/images/gallery/2025-06/scaled-1680-/JkcRtlDIIcunVtNV-image.png)App\\Controllers\\ApiController.php
```php #### Funció loginLogin API. Genera JWT Token
```php /** * Login API to generate JWT token * */ public function login() { helper("form"); $rules = [ 'email' => 'required', 'password' => 'required|min_length[4]' ]; if (!$this->validate($rules)) return $this->fail($this->validator->getErrors()); $model = new UsuarisDemoModel(); $user = $model->getUserByMailOrUsername($this->request->getVar('email')); if (!$user) return $this->failNotFound('Email Not Found'); $verify = password_verify($this->request->getVar('password'), $user['password']); if (!$verify) return $this->fail('Wrong Password'); /****************** GENERATE TOKEN ********************/ helper("jwt"); $APIGroupConfig = "default"; $cfgAPI = new \Config\APIJwt($APIGroupConfig); $data = array( "uid" => $user['id'], "name" => $user['name'], "email" => $user['email'] ); $token = newTokenJWT($cfgAPI->config(), $data); /****************** END TOKEN GENERATION **************/ $response = [ 'status' => 200, 'error' => false, 'messages' => 'User logged In successfully', 'token' => $token ]; return $this->respondCreated($response); } ```Test JWT API. Funció de test JWT
```php /** * API Sample call * */ public function test() { // Get current token payload as object $token_data = json_decode($this->request->header("token-data")->getValue()); // Get current config for this controller request as object // $token_config = json_decode($this->request->header("token-config")->getValue()); // Get JWT policy config // $policy_name = $this->request->header("jwt-policy")->getValue(); // check if user has permission or token policy is ok // if user no authorized // $this->fail("User no valid") $response = [ 'status' => 200, 'error' => false, 'messages' => 'Test function ok', 'data' => [ "data" => time(), "token-username" => $token_data->name, "token-email" => $token_data->email, 'config'=>"la configuració del pacman" ] ]; return $this->respond($response); } ```[Codeigniter 4. CORS Filter](https://codeigniter.com/user_guide/libraries/cors.html "Codeigniter 4. CORS Filter")
Si es vol ajustar la seva implementació es tractaria de crear un nou filtre amb un contingut similar al següent: ```php public function before(RequestInterface $request, $arguments = null) { header("Access-Control-Allow-Origin: *"); header("Access-Control-Allow-Headers: X-API-KEY, Origin,X-Requested-With, Content-Type, Accept, Access-Control-Requested-Method, Authorization"); header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PATCH, PUT, DELETE"); $method = $_SERVER['REQUEST_METHOD']; if ($method == "OPTIONS") { die(); } } ``` i un cop creat el filtre ajustant-ne el contingut a les necessitats del projecte, s'hauria d'activar com a filtre dins l'arxiu ****App\\Config\\Filters.php**** [](https://siensis.com/books/uploads/images/gallery/2025-06/vszYxs0KOQs1kNVH-image.png) # Altres recursos ### Add Token automatically POSTMAN Script to login URL ```javascript pm.globals.set("token", pm.response.json().token); ``` Script to securized APIs. ****Pre-request script**** ```javascript pm.request.headers.add("Authorization: Bearer " + pm.globals.get("token")); ``` ### Enllaços - [Postman. Software tool to check, build APIs](https://www.postman.com/ "Postman. Software tool to check, build APIs") - [Automatic document an API](https://apidocjs.com/ "Automatic document an API") - [Fake API sample](https://fakestoreapi.com/docs "Fake API sample") - [JSON Web Tokens](https://jwt.io/ "JSON Web Tokens") - [PHP Documentor](https://phpdoc.org/ "PHP Documentor") - [RFC JSON Web Tokens](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1 "RFC JSON Web Tokens") ### PDFs - [JWT Handbook](https://siensis.com/books/attachments/1 "JWT Handbook")