Security Restrict-ing Access To Logged In Pages...not "Restricting"

[GraybeardCoder]

I believe I've set this up correctly by following the How To's, but the behavior is not as expected. I've a functioning Security Provider which handles my logins/logouts. It uses my local DB.

For pages that require a login for access, I set up an API called "chksec" and call it directly from each page requiring g_identity to not be empty:

The API looks like this:

Today, I logged in and noticed I was successfully redirected to a restricted page, but my "sign in" button in my navbar was still showing. It changes to "logout" when g_identity is not empty. I then checked dev tools in my browser to find that I had no g_identity number assigned.

Recapping the steps: my login API worked, which includes Security Login as part of its steps. It returned success because my login page redirected me using the success event. But g_identity did not get assigned a number (should have been "1"), and my Security Restrict did not redirect me from the restricted page.

I'm still fairly new to building in Wappler so it's well within my learning curve to have misunderstood something here. I am also editing pages behind the Security Restrict API call, and reloading those pages, along with non-restricted pages, countless times per day. I'd like to feel confident in using this authorization system before pushing this to the public internet. Any ideas how I could further try to diagnose/troubleshoot this behavior?

[Apple]

@GraybeardCoder

But g_identity did not get assigned a number

You posted everything except the part where you define g_identity

P.S.: Hi!

[GraybeardCoder]

So true! Thank you. Updated pic

[GraybeardCoder]

Just logged in again and the same behavior. There is a session cookie hanging around however. Is this allowing access to the restricted pages? You can see the "Sign in" is still reflecting that there's no g_identity set.

[franse]

What if you create some API with identity and output, and test it on browser, still false?

[GraybeardCoder]

The issue may be that I'm relying on g_identity to be set for the show/hide of items in my navbar, but the Security Restrict may also allow a session cookie from the "remember me" check box during login.

Security Restrict seems like a black box to me right now since I'm not familiar with it at all.

[Cheese]

Check your active target matches the environment you are working on... ie, if you have Remote/Production selected and are working Locally/Development there will be issues with changes that you have made to Security Provider not acting as you may expect. If you are working Locally then be sure it is set to Local... And vice versa. If all is good then ignore this.

[franse]

@GraybeardCoder

The issue may be that I'm relying on g_identity to be set for the show/hide of items in my navbar

Yes but I was just asking for testing, what happens when you call an api which has identity on it? Still being false?

[GraybeardCoder]

I have caught myself opening files when the target is set to my remote deployment. But I have manually deleted my session info from the browser. This has not changed the odd behavior however. I can still login, get to my restricted page via redirect, and not have a g_identity set.

[guptast]

Hi David,

I can make one observation regarding the security restrict setup. Permissions under the Restrict Properties for Security Restrict chksec is empty. For the Security Restrict to work correctly, the Permissions property needs to be setup.

Permissions can be defined under 'Users and Permissions` in the siteSecurity (Security Provider).

[GraybeardCoder]

Hi @guptast and thank you for your observation. I was following along with @George how-to here: Security - Restricting Access to Your Page

Step 5, George says no permissions need to be selected if we want all logged in users to have access.

Currently I don't have roles defined in my app, so based on the how-to, it should work if I leave the Permissions property blank.

Please let me know if you feel differently.

[Apple]

I can't see anything wrong

Maybe it's the following issue?

Using memory session store doesn't persist session, so every time you change a server action (which results in NodeJS restart) the session is lost. Use Redis in project settings

Edit: Show the Security Login step... We'll dissect your app

(maybe not me, because I don't have a lot of time)

[GraybeardCoder]

Here's the login API. I'll briefly step through the approach:

• Set Value: Take the person's email address and lowercase() it

• Query: gets the boolean values of two fields in the customer table related to my two-step sign up process.

• Condition: make sure they've completed the two-step sign up process before trying to login

• If they've completed the full sign-up process, execute the Security Login, followed by retrieving a string I use with Node routes to redirect them

That's it.