Unauthenticated and Unauthorized requests

Introduction

With the Socratease library, you can explicitly specify the path that you want it to load. Because Socratease is a front-end library, the user can modify the path to something they shouldn't be allowed to access. (For instance, imagine a teacher created a quiz, and a student loaded the path which shows the list of questions and answers.)

To solve this, Socratease has access management built-in. It uses the username key that you initialize the Socratease library with to decide whether the requested resource should be returned or not.

Code

const options = {
    "config": {
        "login_url_path": "/account/login",
        "next_url_keyword": "next_url"
    }
}

Unauthenticated & Unauthorized

Unauthenticated: If to access a requested resource, a user needs to be logged-in (say a Quiz can only be accessed by logged-in users), and you initialize the library with username=null, the Socratease server will return a 401 Response. It will then automatically redirect the browser to your property's login management page. You can specify this url with the login_url keyword in the config key within the Options dictionary.

Further, with the next_url_keyword key, Socratease can append a URL parameter to login_url_path. You can set up your login management system such that it reads this parameter and then redirects the user to this URL after successful login.

For example, let's say that the user visits yoursite.com/learning/quiz-1.

The user is not logged in, and the URL requires the user to be logged in.
Imagine you have set login_url and next_url_keyword as shown in the example above. The user will first be redirected to yoursite.com/account/login?next_url=yoursite.com%2Flearning%2Fquiz-1
next_url is the URL encoding of the original URL requested by the user
Your login management system can now redirect the user to yoursite.com/learning/quiz-1 and because the user is now logged, she will be able to access Quiz 1.

Unauthorized: Even if a user is logged in, they may be restricted from accessing certain resources (like the student accessing the questions). In this case, the Socratease server will return a 403 Response. It will show a screen saying that the user doesn't have permissions to access that page/resource.