Skip to content

Flowpack.Neos.FrontendLogin:Frontend authentication provider prevents Neos.Neos:Backend to work #36

@mhsdesign

Description

@mhsdesign

after writing the issues title i think i guess this is part of the deal of the package still it got me confused until i dumped out $this->securityContext->getAuthenticationTokens();.

The problem i had is that the plugin Sitegeist.Archaeopteryx comes with certain backend routes like '/sitegeist/archaeopteryx/get-tree' which are not prefixed by '/neos' because naïvely though why should they be? https://github.com/sitegeist/Sitegeist.Archaeopteryx/blob/28f2c159de488e72c6b7bee8ae84bfed5616179f/Configuration/Policy.yaml#L14
They are backend routes because they are still configured to be authenticated via Neos.Neos:Backend.

Now this package restricts the Neos.Neos:Backend authentication provider to only affect paths like '/neos' (which already breaks when another backend endpoint is configured: https://github.com/jvm-tech/JvMTECH.NeosHardening)

requestPatterns:
'Flowpack.Neos.FrontendLogin:NeosBackend':
pattern: Flowpack\Neos\FrontendLogin\Security\NeosRequestPattern

This is part of how this plugin works - just took me some time 😅. I guess the mentioned plugin needs a fix to use use a route starting with '/neos'. Its a little odd to have that hardcoded but ... maybe there should be a warning in the readme?


In case a protected route should be authenticated via the Neos.Neos:Backend provider but the following error is shown instead of a redirect to '/neos', youre attempting to protect a custom 'backend like' route which does not work unless prefixed with 'neos' as long as this package is installed:

Could not authenticate any token.

Might be missing or wrong credentials or no authentication provider matched.
Evaluated following 1 privilege target(s):

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions