For more information, take a look at
To summarize, after logging in, you will receive an AccessToken in the response. This AccessToken can be used in headers or query strings to confirm your logged-in status:
# Authorization Header
curl -X GET -H "Authorization: $ACCESS_TOKEN" \
http://localhost:3000/api/widgets
# Query Parameter
curl -X GET http://localhost:3000/api/widgets?access_token=$ACCESS_TOKEN
It is not easy to fake this as the access token is validated with each request to guarantee its authenticity and validity.
Once this is set up, you can access the accessToken by (referenced from https://github.com/strongloop/loopback/issues/569#issuecomment-60924099, but with user attached to req object)
app.use(function(req, res, next) {
app.currentUser = null;
if (!req.accessToken) return next();
req.accessToken.user(function(err, user) {
if (err) return next(err);
req.currentUser = user;
next();
});
});
Include this in your server.js
or a boot script to have the user
object accessible on ctx.req.currentUser
at any given time.