5

I am curious on the approach I will have to take if I would like to build an app that connects to Drupal. I have already built simple headless drupal app using only get requests.

I am able also to make posts requests with Basic Auth or Auth0 mainly via postman and the concept of this is clear.

What is not clear to me is how I will be able to manage a logged in user from let's say a React/Vue.js app.

Let's say we have an app that servers 2 types of content: News and Events. News is public and Events is for logged in users. News and Events will be two Rest Export views in Drupal and Events will have an authentication method.

Now if a user wants to see Events he/she must be logged in. So the user will login via a login form and the session should be persisted. The app sends the request to Drupal, logs the user in and give a cookie/token/jwt back? So I will be able to use that cookie/token/jwt to access events and events/nid?

What should I use in this case in order to persist a login?

Thanks in advance.

Improve this question
1
  • That entirely depends on you. The mainstream approach is to go with JWT but you are only exchanging a cookie for a local storage in the browser so one way or the other the client still has to have some sort of identifier present in all his requests. The thing with JWT is that the state is moved from server onto the client. This is too broad topic to discuss here.
    – user21641
    Jun 15, 2018 at 21:43

1 Answer 1

Reset to default
6

I'd recommend you look at OAuth 2.0, which more or less standardizes the process of how to get to a valid login state/token.

I used https://www.drupal.org/project/simple_oauth recently in a project, which depends on the oauth2 component of the phpleague, which comes with great documentation: https://oauth2.thephpleague.com/. And the module itself also has a lot of documentation and whole video series on how to configure and use it.

OAuth2 provides 5 different ways to handle what it calls a grant, based on whether your client is an API, another website, a 3rd/1st-party client and so on: https://oauth2.thephpleague.com/authorization-server/which-grant/

E.g if you're OK with the user entering his password then you can just use the password grant, if you don't want that, you can use the oauth/authorize page which then redirects the user back to the app and so on.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.