ivanciric/ecdsa-auth

ECDSA based authentication for Laravel/Dingo API

dev-master 2018-11-23 14:45 UTC

Requires

• dingo/api: 2.0.0-alpha1
• kornrunner/keccak: ^1.0
• simplito/elliptic-php: 1.0.4

MIT

• Ivan Ciric

README

Passwordless authentication based on public/private key signatures.

ECDSA implementation for Laravel/Dingo API with the help of elliptic-php and keccak packages.

Instalation

composer require ivanciric/ecdsa-auth

Library uses package auto-discovery feature, so you don't need to set the service provider manually.

Publish the package configuration

php artisan vendor:publish

Configuration

After publishing configuration, you can edit the available options in config/ecdsaauth.php

Usage

This package presumes you have Dingo API setup. Edit the config/api.php file and set the auth key as follows:

'auth' => [
        'ivanciric\EcdsaAuth\Authenticator'
 ]

You should set the lookup_key and key_lookup_field in the package config to reflect your user properties.

Protect your routes by specifying the middleware:

$api->version('v1', ['middleware' => 'api.auth'], function ($api) {
    ...
});

Creating the payload

Authorization header should contain the payload in the following forms:

Eth eyJlbWFpbCI6ImhhQG1hLnRvIiwibWVzc2FnZSI6IjkyNThhNjQ0Y2FmZTZ...

or

Ecdsa eyJlbWFpbCI6ImhhQG1hLnRvIiwibWVzc2FnZSI6IjkyNThhNjQ0Y2FmZTZ...

Payload itself is a base64 encoded json with the following properties:

{
    "email": "[e-mail]", // user's email or alternative lookup field
    "message": "message that you've signed", // string
    "signature": "3046022100a94c1a..." // signed message
}

All properties are configurable.