CURL php to authenticate user

andy_marampa

I am super new to flarum. Just got a hand of it 2 days ago. I got an old project with CodeIgniter with flarum as forum. Maybe for simplicity the previous developer use flarum user to manage CI users too.

I need to authenticate user into flarum when they log in to CI. I see here look like what I want :

My question what is exactly to put in the 'token' ?

from this :

$api_url = "https://my.forum.url/api/token";

What else do I need to call API through CURL like this. The flarum folder inside the maiin application.

Thanks for helping..

luceos

andy_marampa

$session->token

is part of the response from the Flarum api holding a session based API token.

What you need to modify is the $username and $password variables at the top. It needs to hold the posted value (sanitized) of the user logging in.

andy_marampa

$session is not created yet right ? still null.. at the bottom when it will get assigned. Because I am still on the CI page, not flarum page.

My goal is when user log in to CI, when they go to the flarum no need to login again even-though the username password is same (use same tables).

luceos

$session is the response from the Flarum api. If you send it an authentication request to http://flarumurl/api/token with username and password you should get a token back. It is up to you to set it to the correct $_SESSION variable so that Flarum understands it. Sessions only work on the same domain, so be aware about that.

disclaimer; I haven't checked whether this is the correct flow

andy_marampa

Yes it is still in the same domain. The flarum folder is inside the CI web.

I've got error:
{"errors":[{"status":"401","code":"permission_denied"}]}

Apperantly someone ever got this same error when trying to use token.
https://discuss.flarum.org/d/5352-receive-401-error-when-using-api-to-get-the-token

Unfortunetely he didn't share how to solve it..

Any clue where to check? Thanks

andy_marampa

anyone please.

BlackSheep

andy_marampa It's pretty specific, if people did not answer, you should wait a bit more or try to go ask in the Flarum's discord ?

luceos

One reason it might not be working is CSRF, that's why the master token was introduced. As I didn't check this assumption I didn't reply before.