Authentication

Overview

Finanzapp supports two authentication methods: traditional email/password authentication and Google OAuth integration. All authenticated requests use PHP session-based authentication.

Authentication Methods

Email/Password

Traditional authentication with email and password

Google OAuth

Single sign-on using Google accounts

Email/Password Authentication

const xhr = new XMLHttpRequest();
const formData = new FormData();
formData.append('email', 'user@example.com');
formData.append('password', 'SecurePass123');
formData.append('g-recaptcha-response', recaptchaToken);

xhr.open('POST', 'https://pro.finanzapp.es/app/auth/sendLogin.php', true);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

xhr.onreadystatechange = function () {
  if (xhr.readyState === 4 && xhr.status === 200) {
    const data = JSON.parse(xhr.responseText);
    if (data.success) {
      console.log('Login successful:', data.user);
      // Session is automatically created server-side
    } else {
      console.error('Login failed:', data.message);
    }
  }
};

xhr.send(formData);

const formData = new FormData();
formData.append('email', 'user@example.com');
formData.append('password', 'SecurePass123');

fetch('https://pro.finanzapp.es/app/auth/sendLogin.php', {
  method: 'POST',
  headers: {
    'X-Requested-With': 'XMLHttpRequest'
  },
  body: formData
})
.then(response => response.json())
.then(data => {
  if (data.success) {
    console.log('Login successful:', data.user);
  }
})
.catch(error => console.error('Error:', error));

Request Parameters

string

required

User’s email address (must be a valid email format)

string

required

User’s password (minimum 8 characters, at least one uppercase letter and one number)

string

reCAPTCHA token for bot protection (optional but recommended)

Response

boolean

required

Indicates if the login was successful

string

Human-readable message about the operation

object

User information object (only included on success)

Show user object properties

integer

Unique user identifier

string

User’s email address

string

User’s full name

string

URL to user’s avatar image

integer

Newsletter subscription status (0 or 1)

Example Response

Success

{
  "success": true,
  "message": "Login successful",
  "user": {
    "id": 123,
    "email": "user@example.com",
    "name": "John Doe",
    "url_image": "https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg",
    "accept_news": 1
  }
}

Error - Invalid Credentials

{
  "success": false,
  "message": "Email o contraseña incorrectas"
}

Error - Forbidden Access

{
  "success": false,
  "message": "Access denied"
}

Registration Endpoint

const formData = new FormData();
formData.append('nombre', 'John Doe');
formData.append('email', 'john@example.com');
formData.append('password', 'SecurePass123');
formData.append('confirm-password', 'SecurePass123');
formData.append('terms', 'on');
formData.append('notifications', 'on'); // Optional

const xhr = new XMLHttpRequest();
xhr.open('POST', 'https://pro.finanzapp.es/app/auth/sendRegister.php', true);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

xhr.onreadystatechange = function () {
  if (xhr.readyState === 4 && xhr.status === 200) {
    const data = JSON.parse(xhr.responseText);
    console.log(data);
  }
};

xhr.send(formData);

Request Parameters

string

required

User’s full name

string

required

User’s email address (must be unique and valid)

string

required

User’s password (minimum 8 characters, one uppercase, one number)

string

required

Password confirmation (must match password)

string

required

Terms and conditions acceptance (must be “on”)

string

Newsletter subscription preference (“on” or empty)

Response

boolean

required

Indicates if the registration was successful

string

required

Human-readable message about the operation

Example Response

Success

{
  "success": true,
  "message": "Usuario registrado correctamente"
}

Error - Email Already Exists

{
  "success": false,
  "message": "El email ya está registrado"
}

Google OAuth Authentication

Finanzapp integrates with Google Sign-In for seamless authentication.

function handleCredentialResponse(response) {
  fetch('https://pro.finanzapp.es/app/auth/google-callback-login.php', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      credential: response.credential
    })
  })
  .then(res => res.json())
  .then(data => {
    if (data.status === 'exists') {
      console.log('User already exists, logged in');
    } else if (data.status === 'inserted') {
      console.log('New user created and logged in');
    }
    window.location.href = "/Finanzapp/index.php";
  })
  .catch(error => console.error('Error:', error));
}

<div id="g_id_onload"
  data-client_id="665269631824-25f2bkbj039grhjavj17pkqjsjdqj0jr.apps.googleusercontent.com"
  data-context="signin"
  data-ux_mode="popup"
  data-callback="handleCredentialResponse"
  data-auto_prompt="false">
</div>

<div class="g_id_signin"
  data-type="standard"
  data-shape="rectangular"
  data-theme="outline"
  data-text="signin_with"
  data-size="large"
  data-logo_alignment="left">
</div>

Request Parameters

string

required

Google JWT credential token received from Google Sign-In

Response

string

required

Status of the operation: "exists" (existing user) or "inserted" (new user)

object

User information extracted from Google profile

Register with Google

Similar to login, but uses a redirect mode:

<div id="g_id_onload"
  data-client_id="665269631824-25f2bkbj039grhjavj17pkqjsjdqj0jr.apps.googleusercontent.com"
  data-context="signup"
  data-ux_mode="redirect"
  data-login_uri="https://pro.finanzapp.es/app/auth/google-callback.php"
  data-auto_prompt="false">
</div>

Session Management

Once authenticated, Finanzapp creates a PHP session that persists across requests.

Session Data Structure

The server stores the following information in $_SESSION['user']:

$_SESSION['user'] = [
    'id' => 123,
    'email' => 'user@example.com',
    'name' => 'John Doe',
    'url_image' => 'https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg',
    'accept_news' => 1
];

Checking Authentication Status

Protected pages verify authentication using:

if (empty($_SESSION['user']['id'])) {
    // User not authenticated - redirect to login
    header('Location: /app/login.php');
    exit;
}

Logout

Logout Endpoint

fetch('https://pro.finanzapp.es/app/auth/logout.php', {
  method: 'POST',
  headers: {
    'X-Requested-With': 'XMLHttpRequest'
  }
})
.then(response => response.json())
.then(data => {
  if (data.success) {
    console.log('Logged out successfully');
    window.location.href = '/app/login.php';
  }
})
.catch(error => console.error('Error:', error));

Endpoint Details

URL: POST /app/auth/logout.php Headers Required:

X-Requested-With: XMLHttpRequest

Response

boolean

required

Indicates if logout was successful

string

required

Human-readable message

Implementation

The logout endpoint (source: /home/daytona/workspace/source/app/auth/logout.php:18-21):

session_unset();
session_destroy();

echo json_encode([
    'success' => true, 
    'message' => 'Sesión cerrada correctamente'
]);

Example Response

Success

{
  "success": true,
  "message": "Sesión cerrada correctamente"
}

Error - Invalid Request

{
  "success": false,
  "message": "Método no permitido"
}

Security Considerations

Important Security Notes:

All authentication endpoints require the X-Requested-With: XMLHttpRequest header
Direct browser access to API endpoints will return a 403 Forbidden error
Passwords must meet complexity requirements (8+ chars, uppercase, number)
reCAPTCHA integration prevents automated attacks
Sessions are managed server-side with PHP’s built-in session handling

Password Requirements

Passwords must meet the following criteria (validated client-side and server-side):

Minimum 8 characters
At least one uppercase letter
At least one number
No maximum length limit

function validatePassword(password) {
  const passwordRegex = /^(?=.*[A-Z])(?=.*\d).{8,}$/;
  return passwordRegex.test(password);
}

Error Handling

All authentication endpoints return consistent error responses:

Error Message	Cause
`Acceso prohibido`	Missing or invalid `X-Requested-With` header
`Método no permitido`	Invalid HTTP method (not POST)
`Email o contraseña incorrectas`	Invalid login credentials
`El email ya está registrado`	Email already exists during registration
`No hay una sesión activa`	Session expired or user not logged in

Error messages are returned in Spanish by default. The frontend uses the translation system for internationalization.

API

Overview

Authentication Methods

Email/Password

Google OAuth

Email/Password Authentication

Request Parameters

Response

Example Response

Registration Endpoint

Request Parameters

Response

Example Response

Google OAuth Authentication

Request Parameters

Response

Register with Google

Session Management

Session Data Structure

Checking Authentication Status

Logout

Logout Endpoint

Endpoint Details

Response

Implementation

Example Response

Security Considerations

Password Requirements

Error Handling

Next Steps

API Endpoints

User Management

​Overview

​Authentication Methods

Email/Password

Google OAuth

​Email/Password Authentication

​Login Endpoint

​Request Parameters

​Response

​Example Response

​Registration Endpoint

​Request Parameters

​Response

​Example Response

​Google OAuth Authentication

​Login with Google

​Request Parameters

​Response

​Register with Google

​Session Management

​Session Data Structure

​Checking Authentication Status

​Logout

​Logout Endpoint

​Endpoint Details

​Response

​Implementation

​Example Response

​Security Considerations

​Password Requirements

​Error Handling

​Next Steps

API Endpoints

User Management

Overview

Authentication Methods

Email/Password Authentication

Login Endpoint

Request Parameters

Response

Example Response

Registration Endpoint

Request Parameters

Response

Example Response

Google OAuth Authentication

Login with Google

Request Parameters

Response

Register with Google

Session Management

Session Data Structure

Checking Authentication Status

Logout

Logout Endpoint

Endpoint Details

Response

Implementation

Example Response

Security Considerations

Password Requirements

Error Handling

Next Steps