As a popular PHP framework, Laravel has rich functions and an excellent extension system. In terms of implementing permission management, Laravel also provides rich support, which can easily implement various permission-related functions in the system. However, in actual applications, it may involve permission management between multiple systems, or cross-domain permission verification. In this case, you need to use Laravel's cross-system and cross-domain permission management functions.

This article will introduce how to implement cross-system and cross-domain permission management in Laravel, mainly including the following content:

1. Basic knowledge of permission management in Laravel
2. How Implementing cross-system permission management
3. How to implement cross-domain permission verification
4. Basic knowledge of permission management in Laravel

In Laravel, permission management can be done through Laravel The built-in Auth system implementation provides functions such as user authentication, authorization, and password reset. The authorization function is mainly implemented through the Gate and Policy classes.

Gate is the core class that implements authorization in Laravel. It can be used to define and determine user permissions. In Laravel, you can define Gate in the app/Providers/AuthServiceProvider.php file:

public function boot()
{
    $this->registerPolicies();

    Gate::define('update-post', function ($user, $post) {
        return $user->id === $post->user_id;
    });
}

The above example defines a Gate named "update-post" to determine whether the current user has permission to modify a certain article. The judgment condition is that the current user's ID is equal to the article's author ID.

When using Gate to determine permissions, you can directly use the authorize method:

public function update(Request $request, Post $post)
{
    $this->authorize('update-post', $post);

    //...
}

At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown. If you need to customize the exception information, you can pass in the third parameter in the text, such as:

$this->authorize('update-post', $post, '你沒(méi)有權(quán)限修改這篇文章');

At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown, and the exception information is " You do not have permission to edit this article."

In the above example, we used the direct transmission of the $post object for permission judgment. Of course, if you need to pass other parameters for permission judgment, you can also pass additional data in the form of an array through the third parameter:

$this->authorize('update-post', ['post' => $post, 'extra_data' => 'foo']);

When judging in Gate, you can get the passed data through the second parameter:

Gate::define('update-post', function ($user, $post, $extra_data) {
    // can access $extra_data['extra_data'] here
    return $user->id === $post->user_id;
});

In addition to Gate, Laravel also provides another class called Policy, which can also be used to implement authorization. In contrast, Policy is more flexible and allows developers to implement more fine-grained permission control by defining a public method called can:

class PostPolicy
{
    public function canUpdate($user, Post $post)
    {
        return $user->id === $post->user_id;
    }
}

At this time, when using Gate for permission judgment, you can Use the policy method to associate Gate with Policy:

Gate::policy(Post::class, PostPolicy::class);

$this->authorize('update', $post);

In the above example, we associate the Gate and PostPolicy classes through the policy method, so that when we use the authorize method, Laravel will automatically Call PostPolicy's canUpdate method to determine permissions. At this time, if the current user does not have permission to modify the article, a 403 exception will be thrown.

2. How to implement cross-system permission management

In actual applications, it may be necessary to transfer authorization information from one system to another. For example, when we have completed authentication and authorization in system A, we now need to perform operations in system B, but we do not want the user to need to authenticate and authorize again. At this time, we can transfer the authorization information in system A to system B to achieve seamless permission management.

In Laravel, we can use JWT (JSON Web Token) to achieve cross-system permission management. JWT is an open standard for secure transmission of information in a network environment. It specifies how to securely transmit JSON-based information over the Internet. JWT consists of three parts, namely header, payload and signature. Among them, header and payload are JSON strings encoded using Base64, while signature is a hash value generated from header, payload and secret using encryption algorithms such as HS256.

In Laravel, we can use the tymon/jwt-auth extension package to create and parse JWT. First, you need to install the tymon/jwt-auth extension package:

composer require tymon/jwt-auth

After the installation is complete, we need to perform some basic configuration of JWT. It can be configured in the config/jwt.php file, mainly including:

• secret: encryption key
• ttl: Token validity period, in minutes
• providers: User provider, used to verify user identity

return [
    // ...

    'secret' => env('JWT_SECRET', 'some-secret-string'),

    'ttl' => env('JWT_TTL', 60),

    'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),

    'providers' => [
        'users' => [
            'model' => AppModelsUser::class,
            'credentials' => ['email', 'password'],
        ],
    ],

    // ...
];

After completing the configuration, we can generate a JWT in a system and pass it to another system. In another system, the JWT parsing function can be used to obtain the user information and permission information in the JWT. Specifically, you can use the Auth::setUser method to set the parsed user information as the current user, and use Gate to determine permissions.

The following is a simple example:

In system A, we can use JWT to generate a Token and pass it to system B:

$token = JWTAuth::fromUser($user);

return redirect('http://system-b.com?token=' . $token);

In system B , we can parse the Token to extract the user information and permission information:

use IlluminateSupportFacadesAuth;
use TymonJWTAuthFacadesJWTAuth;

$token = request()->get('token');

$user = JWTAuth::parseToken()->authenticate();

Auth::setUser($user);

// ...

Gate::authorize('update', $post);

在上面的例子中，我們使用JWTAuth::parseToken()方法解析Token，成功后，通過(guò)authenticate()方法獲取到用戶(hù)信息，并使用Auth::setUser方法將用戶(hù)信息設(shè)置為當(dāng)前用戶(hù)。最后，我們可以使用Gate的authorize方法判斷當(dāng)前用戶(hù)是否有權(quán)限進(jìn)行某些操作。

需要注意的是，為了保證傳輸安全，我們應(yīng)該務(wù)必在傳送Token時(shí)進(jìn)行加密傳輸，或使用HTTPS協(xié)議進(jìn)行通信。

3. 如何實(shí)現(xiàn)跨域的權(quán)限驗(yàn)證

在實(shí)際應(yīng)用中，由于系統(tǒng)之間的跨域限制，可能會(huì)導(dǎo)致無(wú)法直接進(jìn)行權(quán)限驗(yàn)證。此時(shí)，我們可以使用跨域資源共享（CORS）解決跨域問(wèn)題。CORS是一種允許服務(wù)器進(jìn)行跨域訪(fǎng)問(wèn)的機(jī)制，可以通過(guò)在響應(yīng)頭中設(shè)置Access-Control-Allow-*等相關(guān)選項(xiàng)實(shí)現(xiàn)。

在Laravel中，要啟用CORS，可以使用spatie/laravel-cors擴(kuò)展包。首先需要安裝該擴(kuò)展包：

composer require spatie/laravel-cors

然后，在config/cors.php文件中進(jìn)行配置：

return [
    'paths' => ['api/*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,
];

在完成配置后，我們可以在需要使用CORS的路由或控制器中添加CORS相關(guān)中間件：

Route::group(['middleware' => ['cors']], function () {
    // ...
});  

public function update(Request $request, Post $post)
{
    $this->authorize('update-post', $post);

    //...
}

在上面的例子中，我們通過(guò)將路由或控制器添加到“cors”中間件組中，啟用了CORS功能。此時(shí)，我們就可以支持跨域的權(quán)限驗(yàn)證了。

需要注意的是，為了避免出現(xiàn)安全問(wèn)題，我們需要仔細(xì)配置CORS相關(guān)參數(shù)，確保只允許來(lái)自指定域名和端口的請(qǐng)求訪(fǎng)問(wèn)我們的系統(tǒng)。同時(shí)，我們也需要在服務(wù)器端使用CSRF和其他相關(guān)功能保護(hù)系統(tǒng)的安全。

以上就是How to implement cross-system and cross-domain management of permissions in Laravel的詳細(xì)介紹。需要說(shuō)明的是，本文只是提供了一些基本的實(shí)現(xiàn)思路和代碼示例，具體的實(shí)現(xiàn)細(xì)節(jié)和方案根據(jù)實(shí)際的應(yīng)用情況會(huì)有所不同。

The above is the detailed content of How to implement cross-system and cross-domain management of permissions in Laravel. For more information, please follow other related articles on the PHP Chinese website!