Home

Awesome

laravel-api-key

Current version Monthly Downloads Total Downloads Build Status

API Key Authorization for Laravel with replay attack prevention

Installation

$ composer require mxl/laravel-api-key

How it works?

Both sides (i.e. client and server) have a secret key. Client calculates a token - hash value for concatenated secret key and current timestamp. The Token and the timestamp are sent with request to server as separate HTTP headers. Server recalculates hash value and validates the token by comparing it with this value and by checking that received timestamp belongs to current time ± window interval.

Configuration

Package uses default configuration from vendor/laravel-api-key/config/apiKey.php:

<?php

return [
    'secret' => env('API_KEY_SECRET'),
    'hash' => env('API_KEY_HASH', 'md5'),
    'timestampHeader' => env('API_KEY_TIMESTAMP_HEADER', 'X-Timestamp'),
    'tokenHeader' => env('API_KEY_TOKEN_HEADER', 'X-Authorization'),
    'window' => env('API_KEY_WINDOW', 30),
];

To change it set environment variables mentioned in this configuration or copy it to your project with:

$ php artisan vendor:publish --provider="MichaelLedin\LaravelApiKey\ApiKeyServiceProvider" --tag=config

and modify config/apiKey.php file.

Notice! If you use php artisan config:cache or php artisan optimize command then you have to publish configuration as described above otherwise env() function will return null for all environment variables. Read more.

The configuration has following parameters:

Usage

Assign the middleware to routes using middleware class name:

use \MichaelLedin\LaravelApiKey\AuthorizeApiKey;

Route::get('admin/profile', function () {
    //
})->middleware(AuthorizeApiKey::class);

or an alias:

Route::get('admin/profile', function () {
    //
})->middleware('apiKey');

Maintainers

Other useful Laravel packages from the author

License

See the LICENSE file for details.