Thank you very much for your detailed explanation.
I have a homepage, which has the Flarum forum on a subdomain. When a user logs into the main page, they also get logged in on the forum. Vice versa for logout. If I use the API master token instead of a generated token for the respective user, I can only log in the admin.
private function getToken($username, $password)
{
$data = [
'identification' => $username,
'password' => $password,
'lifetime' => $this->getLifetimeInSeconds(),
];
$response = $this->sendRequest('/api/token', $data, null, 'POST');
return isset($response['token']) ? $response['token'] : '';
}
private function sendRequest($path, $data, $token, $method)
{
$data_string = json_encode($data);
$ch = curl_init($this->config['forum_url'] . $path);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Content-Length: ' . strlen($data_string),
'Authorization: Token ' . $token
]
);
$result = curl_exec($ch);
return json_decode($result, true);
}
