title: REST API and client on same server, need API authentication?
body: <p><strong>First, let me describe the application:</strong> we are working on a web-based software which is some kind of custom help desk application. It requires the user to login (we use <strong>FOSUserBundle</strong>). After login the user is redirected to the dashboard. From the dashboard there is no more page reload, the frontend is build on Angularjs and the user can get anywhere within the application without page reload. You could speak of a single page application.</p>
  
  <p>So the data that is presented to the user, is fetched from a rest api (we use <strong>FOSRestBundle</strong>). This works quite well at this point. </p>
  
  <p>There is some kind of dilemma. Only our staff will access this application (for now). So a staff member needs to login to access the helpdesk. The data that is pushed to the frontend via angularjs is called via api, so the user that has just logged in needs to authenticate again on every request because of rest.</p>
  
  <p><strong>Problem:</strong> Since the backend runs on symfony2 let us just try to get the user object of the currently logged in user when an api call is made:</p>
  
  <pre><code>$this-&gt;get('security.context')-&gt;getToken()-&gt;getUser()
  </code></pre>
  
  <p>returns <strong>anon.</strong> that stands for anonymous, or</p>
  
  <pre><code>$this-&gt;getUser();
  </code></pre>
  
  <p>returns just <strong>null</strong>.</p>
  
  <p>So the authenticated context seems to be gone when using the rest api. However when I call an action directly without rest, I can get user information.</p>
  
  <p>So what we need is to secure our rest api and get user information on every api call. We don't want third party people to access our application, just staff. I am not familar with OAuth, but the user will be redirected to a third party page to Allow/Deny access to his data? This would not be an option for us.</p>
  
  <p>Based on that information, do you have any suggestions or ideas how to secure the api and transport the user data so that getUser does not return null or anon. but the actuall logged in user?</p>