SLIM 3 logn middleware enter in a loop - .htaccess

Question

i have some problems with a SLIM 3 login middleware.
In any route I try to go i receive this browser error: "ERR_TOO_MANY_REDIRECTS".
It seems to be that SLIM entered a loop and could not render the login page.
What can i do?
I have obviously done the print_r of the session variables and of course it is initially empty and is only populated after the correct login..
This is my index php:
<?
use Slim\Views\PhpRenderer;
session_start();
define( "BASE_URL", "/test/");
define("ROOT_PATH", $_SERVER["DOCUMENT_ROOT"] . "/test/");
require 'vendor/autoload.php';
require 'config/db.php';
require('functions/middleware.php');
use \Psr\Http\Message\ServerRequestInterface as Request;
use \Psr\Http\Message\ResponseInterface as Response;
use Illuminate\Database\Capsule\Manager as Capsule;
$capsule = new Capsule;
$capsule->addConnection([
'driver' => 'mysql',
'host' => DB_HOST,
'port' => DB_PORT,
'database' => DB_NAME,
'username' => DB_USER,
'password' => DB_PASSWORD,
'charset' => 'utf8',
'collation' => 'utf8_unicode_ci',
]);
$capsule->bootEloquent();
$capsule->setAsGlobal();
$config['displayErrorDetails'] = true;
$config['addContentLengthHeader'] = false;
$config['determineRouteBeforeAppMiddleware'] = true;
$app = new \Slim\App(['settings' => $config]);
$container = $app->getContainer();
$container['renderer'] = new PhpRenderer("./templates");
$container['notFoundHandler'] = function ($container) {
return function ($request, $response) use ($container) {
return $container['renderer']->render($response, "/404.php");
};
};
// Apply the middleware to every request.
$app->add($loggedInMiddleware);
include 'routes.php';
$app->run();
And this is the middleware included file:
<?
// Check the user is logged in when necessary.
$loggedInMiddleware = function ($request, $response, $next) {
$route = $request->getAttribute('route');
$routeName = $route->getName();
$groups = $route->getGroups();
$methods = $route->getMethods();
$arguments = $route->getArguments();
# Define routes that user does not have to be logged in with. All other routes, the user
# needs to be logged in with.
$publicRoutesArray = array(
'login',
'logout'
);
if (!$_SESSION && !in_array($routeName, $publicRoutesArray)) {
// redirect the user to the login page and do not proceed.
$response = $response->withRedirect('/test/login');
} else {
if ($routeName == "login")
return $response->withRedirect('/test/dashboard');
// Proceed as normal...
$response = $next($request, $response);
}
return $response;
};
And these are GET and POST login routes:
$app->get('login', function ($request, $response, $args) {
return $this->renderer->render($response, "/login.php", $args);
})->setName('login');
$app->post('login', function ($request, $response, $args) {
$res = [];
if(!$_POST['username'] || !$_POST['password']) {
$res['error'] = "Inserisci i campi richiesti per il LogIn";
return $this->response->withJson($res);
}
$thisUser = \test\Model\users::select("users.*")
->where("username",$_POST['username'])
->where("password",MD5($_POST['password']))
->get();
if (!$thisUser[0]){
$res['error'] = "I dati inseriti non corrispondono a nessun utente";
return $this->response->withJson($res);
}
$_SESSION['user']['id'] = $thisUser[0]['id'];
$_SESSION['user']['username'] = $thisUser[0]['username'];
$_SESSION['user']['role'] = $thisUser[0]['role'];
$_SESSION['user']['name'] = $thisUser[0]['name'];
$_SESSION['user']['profileImg'] = "https://www.media-rdc.com/medias/32d9119760683046ad0c1e2d7e50e009/p_50x50/stsm144.jpg";
$res['success'] = true;
return $this->response->withJson($res);
});
And finally this is my .htaccess:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

Answer 1

Well I've tried many things; I'm not sure if it is the right answer, but it solves the problem (at least on my end):
I've modified your middelware to this:
<?php
function (\Slim\Http\Request $request, \Slim\Http\Response $response, $next) {
$route = $request->getAttribute('route');
if (empty($route)) {
throw new \Slim\Exception\NotFoundException($request, $response);
}
$routeName = $route->getName();
// Define routes that user does not have to be logged in with. All other routes, the user
// needs to be logged in with.
$publicRoutesArray = array(
'login',
'logout'
);
if ( empty($_SESSION['user']) && !in_array($routeName, $publicRoutesArray)) {
// redirect the user to the login page and do not proceed.
return $response->withRedirect('/test/login');
}
// Proceed as normal...
return $next($request, $response);
}
?>
Also it seems that you have to include the test in the defined routes to work (or filter them out in .htaccess)
<?php
$app->get('/test/login', function ($request, $response, $args) {
return $this->renderer->render($response, 'index.phtml', $args);
})->setName('login');
?>
I sincerely hope it helps

Answer 2

You have a session, because you start the session at the very start:
<?
use Slim\Views\PhpRenderer;
session_start();
...
Your middleware is just checking if there is a session, not whether you set the user session variable from the user logging in.
if (!$_SESSION && !in_array($routeName, $publicRoutesArray)) {
// redirect the user to the login page and do not proceed.
$response = $response->withRedirect('/test/login');
} else {
if ($routeName == "login")
return $response->withRedirect('/test/dashboard');
// Proceed as normal...
$response = $next($request, $response);
}
Thus the app will go into the else statement when they hit the login route (and aren't signed in), which will redirect them to the dashboard (pretty sure this is what is "wrong", as you want them to stay there to submit a form to login). When they hit the dashboard, that route is not part of the public routes so it redirects them back to the login page. Thus the cycle continues forever.
Perhaps change:
if (!$_SESSION && in_array($routeName, $publicRoutesArray) === FALSE) {
// redirect the user to the login page and do not proceed.
$response = $response->withRedirect('/test/login');
} else {
to...
if (!isset($_SESSION['user'] && in_array($routeName, $publicRoutesArray) === FALSE) {
// redirect the user to the login page and do not proceed.
$response = $response->withRedirect('/test/login');
} else {