Download as PDF, PPTX
![CONTINUING
• Save the file as client_secrets.json in your website’s home
directory.
• Change the token_uri attribute to have this value:
• https://www.googleapis.com/oauth2/v3/token
• Open https://[domain_name]/manual](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-47-320.jpg)
![AUTHORIZATION URL
https://accounts.google.com/o/oauth2/auth?
response_type=code
&state=RANDOM_GENERATED_CODE
&redirect_uri=[callback_address]
&scope=https://www.googleapis.com/auth/drive.readonly
&state=[generated_state_string]
&client_id=[client_id]](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-49-320.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-54-320.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-55-320.jpg)
![$client = new GuzzleHttpClient();
$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files',
[
'headers' => [
'Authorization' => ‘[TOKEN_TYPE] [ACCESS_TOKEN]’,
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-57-320.jpg)
![// Posted to: https://www.googleapis.com/oauth2/v4/token
$params = [
‘refresh_token' => $refreshToken,
'grant_type' => 'refresh_token',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret()
];
// . . .](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-58-320.jpg)
![INITIALIZATION
$this->provider = new Google([
'clientId' => $this->config->getClientId(),
'clientSecret' => $this->config->getClientSecret(),
'redirectUri' => $this->helper->getCallbackUrl(self::AREA)
]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-61-320.jpg)
![AUTHORIZATION REDIRECT
$url = $this->provider->getAuthorizationUrl(
['scope' => $config::SCOPE]
);
$_SESSION['oauth2_state'] = $this->provider->getState();
header("Location: {$url}");](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-62-320.jpg)
![ACCESSTOKEN
$token = $this->provider->getAccessToken(
'authorization_code', [
'code' => $_GET[‘code']
]
);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-63-320.jpg)
![$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files', [
'headers' => [
'Authorization' => $token->getToken(),
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-64-320.jpg)
![CONTINUING
• Save the file as client_secrets.json in your website’s home
directory.
• Change the token_uri attribute to have this value:
• https://www.googleapis.com/oauth2/v3/token
• Open https://[domain_name]/manual](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-47-2048.jpg)
![AUTHORIZATION URL
https://accounts.google.com/o/oauth2/auth?
response_type=code
&state=RANDOM_GENERATED_CODE
&redirect_uri=[callback_address]
&scope=https://www.googleapis.com/auth/drive.readonly
&state=[generated_state_string]
&client_id=[client_id]](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-49-2048.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-54-2048.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-55-2048.jpg)
![$client = new GuzzleHttpClient();
$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files',
[
'headers' => [
'Authorization' => ‘[TOKEN_TYPE] [ACCESS_TOKEN]’,
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-57-2048.jpg)
![// Posted to: https://www.googleapis.com/oauth2/v4/token
$params = [
‘refresh_token' => $refreshToken,
'grant_type' => 'refresh_token',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret()
];
// . . .](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-58-2048.jpg)
![INITIALIZATION
$this->provider = new Google([
'clientId' => $this->config->getClientId(),
'clientSecret' => $this->config->getClientSecret(),
'redirectUri' => $this->helper->getCallbackUrl(self::AREA)
]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-61-2048.jpg)
![AUTHORIZATION REDIRECT
$url = $this->provider->getAuthorizationUrl(
['scope' => $config::SCOPE]
);
$_SESSION['oauth2_state'] = $this->provider->getState();
header("Location: {$url}");](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-62-2048.jpg)
![ACCESSTOKEN
$token = $this->provider->getAccessToken(
'authorization_code', [
'code' => $_GET[‘code']
]
);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-63-2048.jpg)
![$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files', [
'headers' => [
'Authorization' => $token->getToken(),
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/75/Demystifying-OAuth2-for-PHP-64-2048.jpg)
Uploaded bySWIFTotter Solutions
Demystifying OAuth2 for PHP
This document discusses OAuth 2.0, an authorization protocol that facilitates secure data access without storing user credentials. It outlines the OAuth process, including the role of access tokens, authorization codes, and the different OAuth grant types. Additionally, it provides practical guidance for implementation, particularly with Google API, while emphasizing security measures in storing access tokens and managing user permissions.
More Related Content
Similar to Demystifying OAuth2 for PHP
![OAuth [noddyCha]](https://cdn.slidesharecdn.com/ss_thumbnails/oauthbychaitanya-120507093315-phpapp01-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Demystifying OAuth2 for PHP
- 2. WHO DO YOUTRUSTWITH YOUR USERNAME AND PASSWORD?
- 4. WE NEEDTO ACCESS DATAINTHE CLOUD.
- 5. WE DON’T WANTTOSTORE THEIR USERNAME/PASSWORD.
- 6. THERE MUST BEAN ANSWER.
- 7.
- 8. The framework fora secure link between provider, customer and us.
- 9. OAUTH PROVIDERS • Amazon •Dropbox • Etsy • Evernote • Facebook • GitHub • Google • Instagram • LinkedIn • Microsoft • Paypal • Reddit • SalesForce • StackExchange • Stripe • Trello • Twitter • Vimeo • Yelp https://en.wikipedia.org/wiki/List_of_OAuth_providers
- 10. OAUTH IS… • anAuthorization protocol. • not an Authentication protocol. • (from the perspective of the web developer)
- 11. AUTHORIZATION: “I GIVE YOUPERMISSION.”
- 12. AUTHENTICATION: “I KNOW WHOYOU ARE.”
- 14. AUTHENTICATING USERS • CanOAuth be used to provide “login with…”? • NO: OAuth is not an authentication protocol. • SOLUTION: use OpenID Connect (Google/Microsoft) or similar.
- 15. OAUTH GRANTS • AuthorizationCode grant • Implicit grant • Resource owner credentials grant • Client credentials grant
- 16. WITHOUT OAUTH2 Web DeveloperCustomer Provider (ex. Google API)
- 17. WITH OAUTH Web DeveloperCustomer Provider (ex. Google API) OAuth2
- 18. OAUTH PROCESS: • Weredirect user to provider (Google/Facebook/etc.). • User authorizes us. • We obtain access token. • We make requests with access token.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 32.
- 33. OAUTH PROCESS: • Weredirect user to provider (Google/Facebook/etc.). • User authorizes us. • We obtain access token. • We make requests with access token.
- 34. THE CODES: • Authorizationcode is short-lived. • It is the key to determine who the user is and what they gave access to. • Access token has a longer life. • It is the key that gives access to the user’s resources.
- 35. USERNAME/PASSWORD OAUTH2 Has noexpiration. (unless credentials change) Access token has expiration. Able to access everything in account. Only can access authorized data. Can be used to maliciously take over an account. Access to data can be revoked at any time. Loosing the username/password can mean all data is compromised. Loosing the access token can mean some data is compromised.
- 36.
- 37. Users Developers Provider Client ID ClientSecret Name Allowed Scopes Whitelisted Domains Tokens/Codes
- 38. ID VS SECRET? •Both are for identifying who you are. • Client ID: “public” key • Client Secret: “private” key, never to be sent through user’s browser
- 39. AUTHORIZATION SERVER • Registers/logsin/validates the user. • Checks the client ID. • Validates the scopes that we request access to and ensures those fall within what we originally asked for. • Asks the user whether it is acceptable to give access. • Sends the authorization code through the user to us.
- 40. AUTHORIZATION SERVER • Looksup the authorization code. • Generates the access token. • Returns access token back to us.
- 41. DO IT YOURSELF… •https://oauth2.thephpleague.com/ • As always, an excellent package by the amazing PHP League
- 42. LET’S SEE HOW ITIS DONE!
- 43.
- 44. GOAL: ACCESS LISTOF CUSTOMER FILES IN GOOGLE DRIVE.
- 45.
- 46. ONLINE STEPS • Goto: http://console.developers.google.com/ • Enable Drive API • Create OAuth Credentials
- 47. CONTINUING • Save thefile as client_secrets.json in your website’s home directory. • Change the token_uri attribute to have this value: • https://www.googleapis.com/oauth2/v3/token • Open https://[domain_name]/manual
- 48. OAUTH IN PHP… “Ifdebugging is the process of removing software bugs, then programming must be the process of putting them in.”
- 49.
- 50. REFRESHTOKENS • Refresh tokensare indefinite. • Access tokens have an expiration. • Refresh tokens are used to create new access tokens. • access_type=offline to use refresh tokens.
- 51.
- 53. THE CALLBACK • Success:“code” parameter contains authorization code. • OpenID: State key will be sent back. • Error: “error” parameter contains error message. GET /authorize/?code=4/ASDFASDFASDFASDF123123123123 HTTP/1.1 Host: developers.google.com
- 54. $client = newClient(); $code = $_GET['code'] ?? ''; $params = [ 'code' => $code, 'grant_type' => 'authorization_code', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret(), 'redirect_uri' => $this->helper->getCallbackUrl(self::AREA) ]; $url = “https://www.googleapis.com/oauth2/v4/token”; $response = $client->post($url, ['form_params' => $params]);
- 55. $client = newClient(); $code = $_GET['code'] ?? ''; $params = [ 'code' => $code, 'grant_type' => 'authorization_code', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret(), 'redirect_uri' => $this->helper->getCallbackUrl(self::AREA) ]; $url = “https://www.googleapis.com/oauth2/v4/token”; $response = $client->post($url, ['form_params' => $params]);
- 56.
- 57. $client = newGuzzleHttpClient(); $fileResponse = $client->get( 'https://www.googleapis.com/drive/v2/files', [ 'headers' => [ 'Authorization' => ‘[TOKEN_TYPE] [ACCESS_TOKEN]’, 'Referer' => 'http://oauth2implementation.com' ] ] ); $files = new Files($fileResponse->getBody());
- 58. // Posted to:https://www.googleapis.com/oauth2/v4/token $params = [ ‘refresh_token' => $refreshToken, 'grant_type' => 'refresh_token', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret() ]; // . . .
- 59. IN A LIBRARY… “Thebest performance improvement is the transition from the nonworking state to the working state.” (J. Osterhout)
- 60. LIBRARY: • The PHPlibrary: • The PHP League: OAuth2 Client • https://github.com/thephpleague/oauth2-client
- 61. INITIALIZATION $this->provider = newGoogle([ 'clientId' => $this->config->getClientId(), 'clientSecret' => $this->config->getClientSecret(), 'redirectUri' => $this->helper->getCallbackUrl(self::AREA) ]);
- 62. AUTHORIZATION REDIRECT $url =$this->provider->getAuthorizationUrl( ['scope' => $config::SCOPE] ); $_SESSION['oauth2_state'] = $this->provider->getState(); header("Location: {$url}");
- 63. ACCESSTOKEN $token = $this->provider->getAccessToken( 'authorization_code',[ 'code' => $_GET[‘code'] ] );
- 64. $fileResponse = $client->get( 'https://www.googleapis.com/drive/v2/files',[ 'headers' => [ 'Authorization' => $token->getToken(), 'Referer' => 'http://oauth2implementation.com' ] ] ); $files = new Files($fileResponse->getBody());
- 65. DO: • Protect againstcommon security threats. • Store random state key in the session and send that to the provider. • Store the access token securely.
- 66. ACCESSTOKEN STORAGE • Doyou need to store access token? • Encrypt it. • Store it in the session or the DB. • Maybe? Store encryption key as cookie.
- 67. IMPLICIT GRANT • Usedfor client-side authorization. • Access token is public. • Resource access must be very limited. • Access token is sent back with first round-trip to authorization server.
- 68. CLIENT CREDENTIALS GRANT •Machine-to-machine authentication. • Agreed-upon signature that has limited permissions associated with it.
- 69. INDUSTRYTERMINOLOGY • Client: thesoftware we write. • Resource Server: website with which we will interact. • ex: Google API • Resource Owner: the customer. • ex: the entity who uses our service to access their data.
- 70. OAUTH RESOURCES • Standard: •https://tools.ietf.org/html/rfc6749 • Security: https://tools.ietf.org/html/rfc6819#section-5.3 • Google API: • https://developers.google.com/identity/protocols/OAuth2?hl=en • https://developers.google.com/oauthplayground/
- 71. THE STEPS: • Redirectuser to provider (Google/Facebook/etc.). • Provider authenticates user, user authorizes us. • We exchange authorization code for access token. • We make requests with access token.
- 72.
- 73.