当前位置：首页 > PHP

php oauth实现

2026-02-14 12:23:29PHP

OAuth 2.0 在 PHP 中的实现

OAuth 2.0 是一种授权框架，允许第三方应用在用户授权下访问资源服务器的数据。在 PHP 中可以通过库或手动实现 OAuth 2.0 流程。

使用 League OAuth2 客户端库

League OAuth2 Client 是一个流行的 PHP 库，简化了 OAuth 2.0 的实现。

安装库：

composer require league/oauth2-client

创建提供者实例：

$provider = new \League\OAuth2\Client\Provider\GenericProvider([
    'clientId'                => 'your_client_id',
    'clientSecret'            => 'your_client_secret',
    'redirectUri'             => 'https://your-redirect-uri/callback',
    'urlAuthorize'            => 'https://provider.com/oauth2/auth',
    'urlAccessToken'          => 'https://provider.com/oauth2/token',
    'urlResourceOwnerDetails' => 'https://provider.com/oauth2/resource'
]);

授权流程：

if (!isset($_GET['code'])) {
    $authUrl = $provider->getAuthorizationUrl();
    $_SESSION['oauth2state'] = $provider->getState();
    header('Location: '.$authUrl);
    exit;
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
    unset($_SESSION['oauth2state']);
    exit('Invalid state');
} else {
    $token = $provider->getAccessToken('authorization_code', [
        'code' => $_GET['code']
    ]);

    $resourceOwner = $provider->getResourceOwner($token);
    $userDetails = $resourceOwner->toArray();
}

手动实现 OAuth 2.0 授权码流程

获取授权码：

$authUrl = 'https://provider.com/oauth2/auth?'
    . 'response_type=code'
    . '&client_id=' . urlencode($clientId)
    . '&redirect_uri=' . urlencode($redirectUri)
    . '&state=' . urlencode($state)
    . '&scope=' . urlencode($scope);

header('Location: ' . $authUrl);

交换访问令牌：

$tokenUrl = 'https://provider.com/oauth2/token';
$params = [
    'grant_type' => 'authorization_code',
    'code' => $_GET['code'],
    'redirect_uri' => $redirectUri,
    'client_id' => $clientId,
    'client_secret' => $clientSecret
];

$ch = curl_init($tokenUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
$response = curl_exec($ch);
$tokenData = json_decode($response, true);

刷新令牌实现

当访问令牌过期时，可以使用刷新令牌获取新的访问令牌：

$refreshParams = [
    'grant_type' => 'refresh_token',
    'refresh_token' => $tokenData['refresh_token'],
    'client_id' => $clientId,
    'client_secret' => $clientSecret
];

$ch = curl_init($tokenUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($refreshParams));
$response = curl_exec($ch);
$newTokenData = json_decode($response, true);

保护路由的中间件实现

创建中间件来验证 OAuth 令牌：

function authenticate($token) {
    $introspectUrl = 'https://provider.com/oauth2/introspect';
    $params = [
        'token' => $token,
        'client_id' => $clientId,
        'client_secret' => $clientSecret
    ];

    $ch = curl_init($introspectUrl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
    $response = curl_exec($ch);
    $tokenInfo = json_decode($response, true);

    return $tokenInfo['active'] ?? false;
}