1

I am trying to add authentication to my Play Framework single page app.

What I would like to have is something like:

def unsecured = Action {
    Ok("This action is not secured")
}

def secured = AuthorizedAction {
    // get the authenticated user's ID somehow
    Ok("This action is secured")
}

For a traditional web app, I had previously done this, following Play Framework docs:

def authenticate = Action { implicit request =>
  loginForm.bindFromRequest.fold(
    formWithErrors => BadRequest(views.html.login(formWithErrors)),
    user => {
      Redirect(routes.Application.home).withSession(Security.username -> user._1)
    }
  )
}

def logout = Action {
  Redirect(routes.Auth.login).withNewSession.flashing(
    "success" -> "You are now logged out."
  )
}

and the Authorized Action is extending ActionBuilder as follows:

object AuthorizedAction extends ActionBuilder[Request] with Results {

  /**
   * on auth success: proceed with the request
   * on auth failure: redirect to login page with flash
   */
  def invokeBlock[A](request: Request[A], block: (Request[A]) => Future[Result]) = {
    // TODO: is "isDefined" enough to determine that user is logged in?
    if(request.session.get("username").isDefined) {
      block(request)
    }
    else {
      Future.successful(Redirect(routes.Auth.login).flashing(
        "failure" -> "You must be logged in to access this page."
      ))
    }
  }
}

For single page applications however, this approach doesn't exactly work anymore.

This article by James Ward explains how the new approach is to be designed, and includes a Java implementation: Securing SPA and rest services

The implementation was redone in Scala by Marius Soutier: Securing SPA in Scala

In his example, he implements a Security trait:

trait Security { self: Controller =>

  val cache: CacheApi

  val AuthTokenHeader = "X-XSRF-TOKEN"
  val AuthTokenCookieKey = "XSRF-TOKEN"
  val AuthTokenUrlKey = "auth"

  /** Checks that a token is either in the header or in the query string */
  def HasToken[A](p: BodyParser[A] = parse.anyContent)(f: String => Long => Request[A] => Result): Action[A] =
    Action(p) { implicit request =>
      val maybeToken = request.headers.get(AuthTokenHeader).orElse(request.getQueryString(AuthTokenUrlKey))
      maybeToken flatMap { token =>
        cache.get[Long](token) map { userid =>
          f(token)(userid)(request)
        }
      } getOrElse Unauthorized(Json.obj("err" -> "No Token"))
    }

}

Functions are now secured like this instead of a plain Action:

def ping() = HasToken() { token => userId => implicit request =>
  user.findByID (userId) map { user =>
    Ok(Json.obj("userId" -> userId)).withToken(token -> userId)
  } getOrElse NotFound (Json.obj("err" -> "User Not Found"))
}

where .withToken is defined as:

implicit class ResultWithToken(result: Result) {
  def withToken(token: (String, Long)): Result = {
    cache.set(token._1, token._2, CacheExpiration)
    result.withCookies(Cookie(AuthTokenCookieKey, token._1, None, httpOnly = false))
  }

  def discardingToken(token: String): Result = {
    cache.remove(token)
    result.discardingCookies(DiscardingCookie(name = AuthTokenCookieKey))
  }
}

I am not liking how complex the "ping" function above has become, and would have preferred to use an Action Builder (like the first example), where auth failure is caught and dealt with at a single point. (as of now, if I want to secure functions ping2 and ping3, each one has to check whether the user is found and deal with the "not found" case)

I have tried to put together an action builder, inspired by Marius' implementation, most particularly his use of the cacheApi which is necessary.

However the AuthorizedAction is an object, and cacheApi needs to be injected (so need to change the object to singleton class), or cannot be declared in an object without being defined.

I also feel like the AuthorizedAction needs to remain an object, in order to be used as:

def secured = AuthorizedAction {

Would anyone please clear up the confusion, and possibly help with some implementation details?

Thanks a lot

1 Answer 1

1

The simplest way in my opinion is to go with ActionBuilder. You can define an action builder as a class (and pass it some dependencies) or as an object.

First you'll need to define a type a request that will contain the information about the user:

// You can add other useful information here
case class AuthorizedRequest[A](request: Request[A], user: User) extends WrappedRequest(request)

Now define your ActionBuilder

class AuthorizedAction(userService: UserService) extends ActionBuilder[AuthorizedRequest] {

  override def invokeBlock[A](request: Request[A], block: (AuthorizedRequest[A]) ⇒ Future[Result]): Future[Result] = {
    request.headers.get(AuthTokenHeader).orElse(request.getQueryString(AuthTokenUrlKey)) match {
      case Some(token) => userService.findByToken(token).map {
        case Some(user) =>
          val req = AuthorizedRequest(request, user)
          block(req)
        case None => Future.successful(Results.Unauthorized)
      }
      case None => Future.successful(Results.Unauthorized)
    }

  }
}

Now you can use it in your controller:

val authorizedAction = new AuthorizedAction(userService)
def ping = authorizedAction { request =>
  Ok(Json.obj("userId" -> request.user.id))
}
5
  • thanks for the answer vdebergue. In my case, method "findByToken" is on a singleton class UserService that needs to be injected to "AuthorizedAction". However if I do that, Play expects to specify the userService in the call to authorizedAction: val authorizedAction = new AuthorizedAction(/* specify userservice here */). Any idea how dependency injection would work with your approach? Also is there any reason for the parentheses "()" following "class AuthorizedAction()"?
    – Khorkhe
    Oct 5, 2016 at 19:05
  • I updated my example by injecting the userService in the AuthorizedAction. I don't use Guice but if you do, it would be easy to adapt the code to use it. The parantheses after AuthorizedAction were not needed in the first example.
    – vdebergue
    Oct 6, 2016 at 8:49
  • accepted though modified for my particular case / liking. thanks a lot!
    – Khorkhe
    Oct 9, 2016 at 6:56
  • what does block mean in this context? Jan 27, 2017 at 22:19
  • block is the function that is written by the user of the ActionBuilder. In the example, block will be request => Ok(Json.obj(...))
    – vdebergue
    Jan 28, 2017 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.