You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Queue-it Security Framework is used to ensure that end users cannot bypass the queue by adding a server-side integration to your server. It supports php >= 5.3.3.
6
-
7
-
## Introduction
8
-
When a user is redirected back from the queue to your website, the queue engine can attache a query string parameter (`queueittoken`) containing some information about the user.
9
-
The most important fields of the `queueittoken` are:
10
-
11
-
- q - the users unique queue identifier
12
-
- ts - a timestamp of how long this redirect is valid
2. The validation method sees that the has no Queue-it session cookie and no `queueittoken` and sends him to the correct queue based on the configuration
22
-
3. User waits in the queue
23
-
4. User is redirected back to your website, now with a `queueittoken`
24
-
5. The validation method validates the `queueittoken` and creates a Queue-it session cookie
25
-
6. The user browses to a new page and the Queue-it session cookie will let him go there without queuing again
26
-
27
-
## How to validate a user
28
-
To validate that the current user is allowed to enter your website (has been through the queue) these steps are needed:
29
-
30
-
1. Providing the queue configuration to the KnownUser validation
31
-
2. Validate the `queueittoken` and store a session cookie
2
+
Before getting started please read the [documentation](https://github.com/queueit/Documentation/tree/main/serverside-connectors) to get acquainted with server-side connectors.
32
3
4
+
This connector supports PHP >= 5.3.3.
33
5
34
-
### 1. Providing the queue configuration
35
-
The recommended way is to use the Go Queue-it self-service portal to setup the configuration.
36
-
The configuration specifies a set of Triggers and Actions. A Trigger is an expression matching one, more or all URLs on your website.
37
-
When a user enter your website and the URL matches a Trigger-expression the corresponding Action will be triggered.
38
-
The Action specifies which queue the users should be send to.
39
-
In this way you can specify which queue(s) should protect which page(s) on the fly without changing the server-side integration.
40
-
41
-
This configuration can then be downloaded to your application server.
42
-
Read more about how *[here](https://github.com/queueit/KnownUser.V3.PHP/tree/master/Documentation)*.
43
-
44
-
### 2. Validate the `queueittoken` and store a session cookie
45
-
To validate that the user has been through the queue, use the `KnownUser::validateRequestByIntegrationConfig()` method.
46
-
This call will validate the timestamp and hash and if valid create a "QueueITAccepted-SDFrts345E-V3_[EventId]" cookie with a TTL as specified in the configuration.
47
-
If the timestamp or hash is invalid, the user is send back to the queue.
48
-
6
+
You can find the latest released version [here](https://github.com/queueit/KnownUser.V3.PHP/releases/latest) and packagist package [here](https://packagist.org/packages/queueit/knownuserv3).
49
7
50
8
## Implementation
51
9
The KnownUser validation must be done on *all requests except requests for static and cached pages, resources like images, css files and ...*.
@@ -54,7 +12,6 @@ So, if you add the KnownUser validation logic to a central place, then be sure t
54
12
If we have the `integrationconfig.json` copied in the folder beside other knownuser files inside web application folder then
55
13
the following method is all that is needed to validate that a user has been through the queue:
56
14
57
-
58
15
```php
59
16
require_once( __DIR__ .'Models.php');
60
17
require_once( __DIR__ .'KnownUser.php');
@@ -130,28 +87,9 @@ So if your webserver is e.g. behind a load balancer that modifies the host name
130
87
return $myUrl;
131
88
}
132
89
```
133
-
### Protecting ajax calls
134
-
If you need to protect AJAX calls beside page loads you need to add the below JavaScript tags to your pages:
If your application server (maybe due to security reasons) is not allowed to do external GET requests, then you have three options:
151
90
152
-
1. Manually download the configuration file from Queue-it Go self-service portal, save it on your application server and load it from local disk
153
-
2. Use an internal gateway server to download the configuration file and save to application server
154
-
3. Specify the configuration in code without using the Trigger/Action paradigm. In this case it is important *only to queue-up page requests* and not requests for resources.
91
+
## Implementation using inline queue configuration
92
+
Specify the configuration in code without using the Trigger/Action paradigm. In this case it is important *only to queue-up page requests* and not requests for resources.
155
93
This can be done by adding custom filtering logic before caling the `KnownUser::resolveQueueRequestByLocalConfig()` method.
156
94
157
95
The following is an example of how to specify the configuration in code:
0 commit comments