Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add pkce support #454

Merged
merged 8 commits into from
May 11, 2023
Merged

feat: add pkce support #454

merged 8 commits into from
May 11, 2023

Conversation

bshaffer
Copy link
Contributor

@bshaffer bshaffer commented May 9, 2023

In order to support PKCE for OAuth2, adds the following public methods:

  • OAuth2::generateCodeVerifier(): string
  • OAuth2::setCodeVerifier(?string $codeVerifier): void
  • OAuth2::getCodeVerifier(): ?string

Usage

Authorization Request

$auth = new OAuth2(['client_id' => $clientId, 'client_secret' => $clientSecret]);

// Example of how a developer might save the code verifier in a stateless application
// NOTE: calling "generateCodeVerifier" will enable PKCE
$_SESSION['code_verifier'] = $auth->generateCodeVerifier();

// The authorization URI will include "code_challenge" and "code_challenge_method"
// querystring parameters if a code verifier is supplied
// (e.g. https://example.com?code_challenge=[base64 code_verifier]&code_challenge_method=S256)
redirect($auth->buildFullAuthorizationUri());

Token Request

$auth = new OAuth2(['client_id' => $clientId, 'client_secret' => $clientSecret]);

// example of how a developer might retrieve the code verifier in a stateless application
$codeVerifier = $_SESSION['code_verifier'];

// The token URI will include "code_verifier" in the request body if a code verifier is supplied
$auth->setCodeVerifier($codeVerifier);
$token = $auth->fetchAuthToken();

See b/270198724

@bshaffer bshaffer requested a review from TimurSadykov May 9, 2023 22:26
@bshaffer bshaffer marked this pull request as ready for review May 9, 2023 22:31
@bshaffer bshaffer requested a review from a team as a code owner May 9, 2023 22:31
@bshaffer bshaffer requested a review from a team May 10, 2023 00:22
Copy link
Member

@TimurSadykov TimurSadykov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, please let Carl to look as well

Copy link

@clundin25 clundin25 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome stuff!

src/OAuth2.php Outdated Show resolved Hide resolved
src/OAuth2.php Outdated Show resolved Hide resolved
Co-authored-by: Vishwaraj Anand <vishwaraj.anand00@gmail.com>
Copy link
Contributor

@vishwarajanand vishwarajanand left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm

@bshaffer bshaffer merged commit 1326c81 into main May 11, 2023
@bshaffer bshaffer deleted the pkce branch May 11, 2023 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants