This repository was archived by the owner on Jun 8, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathauthenticate.php
More file actions
69 lines (62 loc) · 2.36 KB
/
Copy pathauthenticate.php
File metadata and controls
69 lines (62 loc) · 2.36 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
<?php
if (!isset($_SERVER['HTTP_AUTHORIZATION']) || strlen($_SERVER['HTTP_AUTHORIZATION']) < 1) {
$response = new Response();
$response->setHttpStatusCode(401);
$response->setSuccess(false);
(!isset($_SERVER['HTTP_AUTHORIZATION']) ? $response->addMessage("Error: Access token not received.") : false);
(strlen($_SERVER['HTTP_AUTHORIZATION'] < 1) ? $response->addMessage("Error: Access token cannot be blank.") : false);
$response->send();
exit();
}
$accessToken = $_SERVER['HTTP_AUTHORIZATION'];
try {
$query = $writeDB->prepare("SELECT `account_id`, UNIX_TIMESTAMP(`access_token_expiry`) AS `access_token_expiry`, `is_active`, `login_attempts` FROM `sessions`, `accounts` WHERE `sessions`.`account_id` = `accounts`.`id` AND `access_token` = :accessToken");
$query->bindParam(":accessToken", $accessToken, PDO::PARAM_STR);
$query->execute();
$rowCount = $query->rowCount();
if ($rowCount === 0) {
$response = new Response();
$response->setHttpStatusCode(401);
$response->setSuccess(false);
$response->addMessage("Error: access token provided is invalid.");
$response->send();
exit();
}
$row = $query->fetch(PDO::FETCH_OBJ);
$_accountID = $row->account_id;
$_accessExpiry = $row->access_token_expiry;
$_isActive = $row->is_active;
$_loginAttempts = $row->login_attempts;
if ($_loginAttempts > 2) {
$response = new Response();
$response->setHttpStatusCode(401);
$response->setSuccess(false);
$response->addMessage('User account currently locked.');
$response->send();
exit();
}
if ($_accessExpiry < time()) {
$response = new Response();
$response->setHttpStatusCode(401);
$response->setSuccess(false);
$response->addMessage('Access token expired.');
$response->send();
exit();
}
if (!$_isActive) {
$response = new Response();
$response->setHttpStatusCode(401);
$response->setSuccess(false);
$response->addMessage('User account currently inactive.');
$response->send();
exit();
}
} catch (PDOException $e) {
$response = new Response();
$response->setHttpStatusCode(500);
$response->setSuccess(false);
$response->addMessage('User authentication failed. Please try again.');
$response->send();
exit();
}
?>