Using Auth authorization technology in ThinkPHP6

With the continuous development of Internet applications, the security of Web applications has become an increasingly important issue. How to ensure the security of programs has become a problem faced by all developers. Auth authorization technology is a popular solution that provides role-based access control.

In this article, we will explore how to use Auth authorization technology in ThinkPHP6. First, we need to clarify the working principle and core concepts of Auth authorization.

1. How Auth authorization works

The core of Auth authorization is role-based access control, which is mainly divided into the following three steps:

1.1 Create a role

Before using Auth authorization, you first need to create a role. A role is a set of permissions that defines the access a user has.

1.2 Assign permissions to roles

After creating a role, you need to assign the corresponding permissions to the role. Permissions refer to the authorization of which functional modules or data can be accessed.

1.3 Assign roles to users

Finally, you need to assign roles to users. A user can be assigned multiple roles, which determine the access rights the user has.

In the Auth authorization workflow, use the Access controller to implement access control. The Access controller is used to check whether the user has access rights to the current URL. If the user has access rights, he or she can continue to access the relevant content.

2. Using Auth authorization technology in ThinkPHP6

Now that we have understood how Auth authorization works, below we will explain in detail how to use Auth authorization technology in ThinkPHP6. Suppose we have two kinds of users in the background: administrators and ordinary users. Administrators can access all content modules, while ordinary users can only access some content.

2.1 Install and configure the Auth plug-in

Before using Auth technology, we need to install and configure the Auth plug-in first. In ThinkPHP6, the Auth plug-in has been integrated into the framework and can be used with simple configuration.

First, create the auth.php configuration file in the config directory. The configuration information is as follows:

return [
    // 用户认证的类名，不设置则使用核心集成认证方法
    'auth'     => AppAuth::class,
    // 不需要认证的路由，可允许所有用户访问的路由
    'no_auth'  => ['index/index'],
    // 需要认证且验证失败时跳转的地址
    'fail_url' => 'index/login',
];

2.2 Create a User model

Create a User model. The relevant code is as follows:

<?php
namespace appmodel;

use thinkModel;

class User extends Model {

    // 定义角色关联
    public function roles() {
        return $this->belongsToMany(Role::class, 'user_role');
    }

    // 判断用户是否有权限访问当前操作
    public function hasPermission($permission) {
        foreach ($this->roles as $role) {
            if ($role->checkPermission($permission)) {
                return true;
            }
        }

        return false;
    }
}

2.3 Create a Role model

Create a Role model, the relevant code is as follows:

<?php
namespace appmodel;

use thinkModel;

class Role extends Model {

    // 定义权限关联
    public function permissions() {
        return $this->belongsToMany(Permission::class, 'role_permission');
    }

    // 检查角色是否有权限访问当前操作
    public function checkPermission($permission) {
        foreach ($this->permissions as $item) {
            if ($item->name == $permission) {
                return true;
            }
        }

        return false;
    }
}

2.4 Create a Permission model

Create a Permission model, the relevant code is as follows:

<?php
namespace appmodel;

use thinkModel;

class Permission extends Model {
}

2.5 Create database tables

Create database tables, including user table, role table, permission table and two relational tables user_role and role_permission.

User table related structure:

Field	Type	Comment
id	int
username	varchar(20)
password	varchar(255)
created_at	datetime
updated_at	datetime

role table Related structures:

Field	Type	Comment
id	int
name	varchar(20)
created_at	datetime
updated_at	datetime

Permission table related structure:

Field	Type	Comment
id	int
name	varchar(20 )

user_role table related structure:

Field	Type	Comment
id	int
user_id	int
role_id	int

role_permission table related structure:

Field	Type	Comment
id	int
role_id	int
permission_id	int

2.6 Controller code implementation

The following uses a sample controller to illustrate how to implement Auth authorization. The sample controller code is as follows:

<?php
namespace appdmincontroller;

use appmodelUser;
use thinkController;

class Index extends Controller {

    // 后台首页
    public function index() {
        // 获取当前登录用户
        $user_id = session('user_id');
        $user = User::find($user_id);

        // 判断用户是否有权限访问当前操作
        if (!$user->hasPermission($this->request->path())) {
            $this->error('无权访问');
        }

        return view();
    }

    // 登录页面
    public function login() {
        return view();
    }

    // 处理登录请求
    public function do_login() {
        $username = $this->request->param('username');
        $password = $this->request->param('password');

        // 根据用户名查询用户
        $user = User::where('username', $username)->find();

        // 验证用户密码
        if ($user && password_verify($password, $user->password)) {
            // 记录登录状态
            session('user_id', $user->id);

            // 跳转到后台首页
            $this->redirect('index/index');
        } else {
            $this->error('登录失败');
        }
    }

    // 退出登录
    public function logout() {
        session('user_id', null);
        $this->redirect('index/login');
    }
}

3. Summary

In this article, we introduced the working principle, core concepts and application implementation of Auth authorization in ThinkPHP6. Using Auth authorization technology can effectively improve the security of web applications and provide users with more secure and reliable services. In the subsequent web application development process, we should also pay attention to security guarantees and make best use of existing security technologies as much as possible.

The above is the detailed content of Using Auth authorization technology in ThinkPHP6. For more information, please follow other related articles on the PHP Chinese website!