Symfony2 Oauth2 Server with authorization code grant, Symfony2 APIRest and Angular JS client

Vote count:

0

What I have:

-API Rest in Symfony2 using friendsofsymfony/rest-bundle exposing some resources.

-Oauth2 server in Symfony2 using FOSOAuthServerBundle.

-Client in Angular.js doing requests to the API Rest. This client currently gets to login via the authorization code grant (using Hello.js with a custom module), and gets the access token effectively.

I want these API resources secured, so:

-On API Rest app: I implemented the AuthenticationEntryPointInterface which I set as the entry_point in security.yml, to return 401 code and application/json content-type on rejected.

-Client intercepts 401 responses and sends the user to the login form.

-Client sends api rest requests with X-Access-Token set on header.

My current issues:

1) I'm not sure whether I should be setting X-Access-Token on client for requests, I understand this is the right way? Or should I leave it all to hello.js api methods?

2) I have no idea how to make the API Rest app "ask" the oauth server "is this token ok? who does it belong to?" Is this already solved in Symfony?

Thanks a lot for any answer or guideline. Feel free to require any further information or code for what I describe.

asked 1 min ago

Martu

1