Demystifying OAuth2 for PHP
1 like1,180 views
This document discusses OAuth 2.0, an authorization protocol that facilitates secure data access without storing user credentials. It outlines the OAuth process, including the role of access tokens, authorization codes, and the different OAuth grant types. Additionally, it provides practical guidance for implementation, particularly with Google API, while emphasizing security measures in storing access tokens and managing user permissions.
![CONTINUING
• Save the file as client_secrets.json in your website’s home
directory.
• Change the token_uri attribute to have this value:
• https://www.googleapis.com/oauth2/v3/token
• Open https://[domain_name]/manual](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-47-320.jpg)
![AUTHORIZATION URL
https://accounts.google.com/o/oauth2/auth?
response_type=code
&state=RANDOM_GENERATED_CODE
&redirect_uri=[callback_address]
&scope=https://www.googleapis.com/auth/drive.readonly
&state=[generated_state_string]
&client_id=[client_id]](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-49-320.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-54-320.jpg)
![$client = new Client();
$code = $_GET['code'] ?? '';
$params = [
'code' => $code,
'grant_type' => 'authorization_code',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret(),
'redirect_uri' => $this->helper->getCallbackUrl(self::AREA)
];
$url = “https://www.googleapis.com/oauth2/v4/token”;
$response = $client->post($url, ['form_params' => $params]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-55-320.jpg)
![$client = new GuzzleHttpClient();
$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files',
[
'headers' => [
'Authorization' => ‘[TOKEN_TYPE] [ACCESS_TOKEN]’,
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-57-320.jpg)
![// Posted to: https://www.googleapis.com/oauth2/v4/token
$params = [
‘refresh_token' => $refreshToken,
'grant_type' => 'refresh_token',
'client_id' => $this->config->getClientId(),
'client_secret' => $this->config->getClientSecret()
];
// . . .](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-58-320.jpg)
![INITIALIZATION
$this->provider = new Google([
'clientId' => $this->config->getClientId(),
'clientSecret' => $this->config->getClientSecret(),
'redirectUri' => $this->helper->getCallbackUrl(self::AREA)
]);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-61-320.jpg)
![AUTHORIZATION REDIRECT
$url = $this->provider->getAuthorizationUrl(
['scope' => $config::SCOPE]
);
$_SESSION['oauth2_state'] = $this->provider->getState();
header("Location: {$url}");](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-62-320.jpg)
![ACCESSTOKEN
$token = $this->provider->getAccessToken(
'authorization_code', [
'code' => $_GET[‘code']
]
);](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-63-320.jpg)
![$fileResponse = $client->get(
'https://www.googleapis.com/drive/v2/files', [
'headers' => [
'Authorization' => $token->getToken(),
'Referer' => 'http://oauth2implementation.com'
]
]
);
$files = new Files($fileResponse->getBody());](https://image.slidesharecdn.com/demystifyingoauth-150902013519-lva1-app6891/85/Demystifying-OAuth2-for-PHP-64-320.jpg)
Demystifying OAuth2 for PHP
- 2. WHO DO YOUTRUST WITH YOUR USERNAME AND PASSWORD?
- 4. WE NEEDTO ACCESS DATA INTHE CLOUD.
- 5. WE DON’T WANTTO STORE THEIR USERNAME/PASSWORD.
- 6. THERE MUST BE AN ANSWER.
- 8. The framework for a secure link between provider, customer and us.
- 9. OAUTH PROVIDERS • Amazon • Dropbox • Etsy • Evernote • Facebook • GitHub • Google • Instagram • LinkedIn • Microsoft • Paypal • Reddit • SalesForce • StackExchange • Stripe • Trello • Twitter • Vimeo • Yelp https://en.wikipedia.org/wiki/List_of_OAuth_providers
- 10. OAUTH IS… • an Authorization protocol. • not an Authentication protocol. • (from the perspective of the web developer)
- 11. AUTHORIZATION: “I GIVE YOU PERMISSION.”
- 12. AUTHENTICATION: “I KNOW WHO YOU ARE.”
- 14. AUTHENTICATING USERS • Can OAuth be used to provide “login with…”? • NO: OAuth is not an authentication protocol. • SOLUTION: use OpenID Connect (Google/Microsoft) or similar.
- 15. OAUTH GRANTS • Authorization Code grant • Implicit grant • Resource owner credentials grant • Client credentials grant
- 16. WITHOUT OAUTH2 Web Developer Customer Provider (ex. Google API)
- 17. WITH OAUTH Web Developer Customer Provider (ex. Google API) OAuth2
- 18. OAUTH PROCESS: • We redirect user to provider (Google/Facebook/etc.). • User authorizes us. • We obtain access token. • We make requests with access token.
- 30. 100GRANDESCROW
- 33. OAUTH PROCESS: • We redirect user to provider (Google/Facebook/etc.). • User authorizes us. • We obtain access token. • We make requests with access token.
- 34. THE CODES: • Authorization code is short-lived. • It is the key to determine who the user is and what they gave access to. • Access token has a longer life. • It is the key that gives access to the user’s resources.
- 35. USERNAME/PASSWORD OAUTH2 Has no expiration. (unless credentials change) Access token has expiration. Able to access everything in account. Only can access authorized data. Can be used to maliciously take over an account. Access to data can be revoked at any time. Loosing the username/password can mean all data is compromised. Loosing the access token can mean some data is compromised.
- 36. THE PROVIDER?
- 37. Users Developers Provider Client ID Client Secret Name Allowed Scopes Whitelisted Domains Tokens/Codes
- 38. ID VS SECRET? • Both are for identifying who you are. • Client ID: “public” key • Client Secret: “private” key, never to be sent through user’s browser
- 39. AUTHORIZATION SERVER • Registers/logs in/validates the user. • Checks the client ID. • Validates the scopes that we request access to and ensures those fall within what we originally asked for. • Asks the user whether it is acceptable to give access. • Sends the authorization code through the user to us.
- 40. AUTHORIZATION SERVER • Looks up the authorization code. • Generates the access token. • Returns access token back to us.
- 41. DO IT YOURSELF… • https://oauth2.thephpleague.com/ • As always, an excellent package by the amazing PHP League
- 42. LET’S SEE HOW IT IS DONE!
- 43. PROVIDER: GOOGLE
- 44. GOAL: ACCESS LIST OF CUSTOMER FILES IN GOOGLE DRIVE.
- 46. ONLINE STEPS • Go to: http://console.developers.google.com/ • Enable Drive API • Create OAuth Credentials
- 47. CONTINUING • Save the file as client_secrets.json in your website’s home directory. • Change the token_uri attribute to have this value: • https://www.googleapis.com/oauth2/v3/token • Open https://[domain_name]/manual
- 48. OAUTH IN PHP… “If debugging is the process of removing software bugs, then programming must be the process of putting them in.”
- 50. REFRESHTOKENS • Refresh tokens are indefinite. • Access tokens have an expiration. • Refresh tokens are used to create new access tokens. • access_type=offline to use refresh tokens.
- 53. THE CALLBACK • Success: “code” parameter contains authorization code. • OpenID: State key will be sent back. • Error: “error” parameter contains error message. GET /authorize/?code=4/ASDFASDFASDFASDF123123123123 HTTP/1.1 Host: developers.google.com
- 54. $client = new Client(); $code = $_GET['code'] ?? ''; $params = [ 'code' => $code, 'grant_type' => 'authorization_code', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret(), 'redirect_uri' => $this->helper->getCallbackUrl(self::AREA) ]; $url = “https://www.googleapis.com/oauth2/v4/token”; $response = $client->post($url, ['form_params' => $params]);
- 55. $client = new Client(); $code = $_GET['code'] ?? ''; $params = [ 'code' => $code, 'grant_type' => 'authorization_code', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret(), 'redirect_uri' => $this->helper->getCallbackUrl(self::AREA) ]; $url = “https://www.googleapis.com/oauth2/v4/token”; $response = $client->post($url, ['form_params' => $params]);
- 57. $client = new GuzzleHttpClient(); $fileResponse = $client->get( 'https://www.googleapis.com/drive/v2/files', [ 'headers' => [ 'Authorization' => ‘[TOKEN_TYPE] [ACCESS_TOKEN]’, 'Referer' => 'http://oauth2implementation.com' ] ] ); $files = new Files($fileResponse->getBody());
- 58. // Posted to: https://www.googleapis.com/oauth2/v4/token $params = [ ‘refresh_token' => $refreshToken, 'grant_type' => 'refresh_token', 'client_id' => $this->config->getClientId(), 'client_secret' => $this->config->getClientSecret() ]; // . . .
- 59. IN A LIBRARY… “The best performance improvement is the transition from the nonworking state to the working state.” (J. Osterhout)
- 60. LIBRARY: • The PHP library: • The PHP League: OAuth2 Client • https://github.com/thephpleague/oauth2-client
- 61. INITIALIZATION $this->provider = new Google([ 'clientId' => $this->config->getClientId(), 'clientSecret' => $this->config->getClientSecret(), 'redirectUri' => $this->helper->getCallbackUrl(self::AREA) ]);
- 62. AUTHORIZATION REDIRECT $url = $this->provider->getAuthorizationUrl( ['scope' => $config::SCOPE] ); $_SESSION['oauth2_state'] = $this->provider->getState(); header("Location: {$url}");
- 63. ACCESSTOKEN $token = $this->provider->getAccessToken( 'authorization_code', [ 'code' => $_GET[‘code'] ] );
- 64. $fileResponse = $client->get( 'https://www.googleapis.com/drive/v2/files', [ 'headers' => [ 'Authorization' => $token->getToken(), 'Referer' => 'http://oauth2implementation.com' ] ] ); $files = new Files($fileResponse->getBody());
- 65. DO: • Protect against common security threats. • Store random state key in the session and send that to the provider. • Store the access token securely.
- 66. ACCESSTOKEN STORAGE • Do you need to store access token? • Encrypt it. • Store it in the session or the DB. • Maybe? Store encryption key as cookie.
- 67. IMPLICIT GRANT • Used for client-side authorization. • Access token is public. • Resource access must be very limited. • Access token is sent back with first round-trip to authorization server.
- 68. CLIENT CREDENTIALS GRANT • Machine-to-machine authentication. • Agreed-upon signature that has limited permissions associated with it.
- 69. INDUSTRYTERMINOLOGY • Client: the software we write. • Resource Server: website with which we will interact. • ex: Google API • Resource Owner: the customer. • ex: the entity who uses our service to access their data.
- 70. OAUTH RESOURCES • Standard: • https://tools.ietf.org/html/rfc6749 • Security: https://tools.ietf.org/html/rfc6819#section-5.3 • Google API: • https://developers.google.com/identity/protocols/OAuth2?hl=en • https://developers.google.com/oauthplayground/
- 71. THE STEPS: • Redirect user to provider (Google/Facebook/etc.). • Provider authenticates user, user authorizes us. • We exchange authorization code for access token. • We make requests with access token.
- 72. QUESTIONS?