Used to maintain the status of requests and callbacks, and bring them back to the third party as they are after authorizing the request. This parameter can be used to prevent CSRF attacks (cross-site request forgery attacks). It is recommended that third parties bring this parameter. It can be set to a simple random number plus session for verification

##No

# at the bottom of the document

Parameter Description

Step 2: Get access_token through code

Get access_token through code

https://api.weixin.qq.com/sns/oauth2/access_token?appid=APPID&secret=SECRET&code=CODE&grant_type=authorization_code

Parameter Description

Correct return:

"access_token":"ACCESS_TOKEN", "expires_in":7200, &lt;br/&gt;"refresh_token":"REFRESH_TOKEN",<br/>"openid":"OPENID", &lt;br/&gt;"scope":"SCOPE","unionid":"o6_bmasdasdsad6_2sgVt7hMZOPfL"}<br/><br/>

1. If the access_token has timed out, then refresh_token will get a new access_token with a new timeout time;

Return instructions

Correct return:

{ <br/>"access_token":"ACCESS_TOKEN", <br/>"expires_in":7200, <br/>"refresh_token ":"REFRESH_TOKEN", <br/>"openid":"OPENID", <br/>"scope":"SCOPE" <br/>}

Note:

1. Appsecret is the key used by the application interface. If leaked, it may lead to application data leakage, application High-risk consequences such as user data leakage; stored on the client, it is very likely to be maliciously stolen (such as decompiling to obtain the Appsecret);

2. Access_token is the credential for users to authorize third-party applications to initiate interface calls (equivalent to (in user login state), stored on the client, user data may be leaked after maliciously obtaining access_token, user WeChat related interface functions may be maliciously initiated, etc.;

3. refresh_token is used to authorize third-party applications for users. Long-term credentials are only used to refresh access_token, but if leaked, it will be equivalent to access_token leakage, and the risk is the same as above.

It is recommended to put the secret and user data (such as access_token) on the App cloud server, and the cloud transfer interface calls the request.

After obtaining the access_token, make the interface call with the following prerequisites:

1. The access_token is valid and has not expired;

2. The WeChat user has authorized the corresponding interface scope (scope) of the third-party application account.

For interface scope (scope), the interfaces that can be called are as follows:

Among them, snsapi_base belongs to the basic interface. If the application already has other scope permissions, it will have the permissions of snsapi_base by default. Using snsapi_base can allow mobile web page authorization to bypass the action of jumping to the authorization login page to request user authorization, and directly jump to the third-party web page with the authorization temporary ticket (code), but this will make the user's authorized scope (scope) only snsapi_base , resulting in the inability to obtain data and basic functions that require user authorization.

F.A.Q

1. What is an authorization temporary ticket (code)?

Answer: A third party needs to use the code to obtain the access_token. The timeout of the code is 10 minutes. A code can only be successfully exchanged for the access_token once and then it will become invalid. The temporary and one-time nature of the code ensures the security of WeChat authorized login. Third parties can further enhance the security of their own authorized logins by using https and state parameters.

2. What is authorization scope?

Answer: Authorization scope (scope) represents the interface permissions authorized by users to third parties. Third-party applications need to apply to the WeChat open platform for permission to use the corresponding scope, and then use the method described in the document to allow users to authorize. After user authorization, the interface can be called only after obtaining the corresponding access_token.

3. What is the role of the style field in the WeChat login JS code embedded in the website?

Answer: The color style of the third-party page may be light or dark. If the third-party page has a light background, the style field should provide a "black" value (or not, black is the default value), then The corresponding WeChat login text style is black. The related effects are as follows:

If the "white" value is provided, the corresponding text description will be displayed in white, suitable for dark backgrounds. The relevant effects are as follows:

4. What is the role of the href field in the WeChat login JS code with a QR code embedded in the website?

Answer: If a third party feels that the default style provided by the WeChat team does not match its own page style, it can provide its own style file to override the default style. For example, if a third party feels that the default QR code is too large, it can provide relevant css style files and fill in the link address into the href field

.impowerBox .qrcode {width:200px;}<br/>.impowerBox .title {display: none;}<br/>.impowerBox .info {width: 200px;}<br/>.status_icon {display：none}<br/> .impowerBox .status {text-align: center;}

The relevant effects are as follows:

Get user personal information (UnionID mechanism)

Interface Description

This interface is used to obtain user personal information. Developers can obtain basic user information through OpenID. It is particularly important to note that if a developer has multiple mobile applications, website applications and public accounts, the user can be uniquely distinguished by obtaining the unionid in the user’s basic information, because as long as they are mobile applications under the same WeChat open platform account , website applications and public accounts, the user's unionid is unique. In other words, for the same user, the unionid is the same for different applications under the same WeChat open platform.

Request description

http request method: GET

https://api.weixin.qq.com/sns/userinfo?access_token=ACCESS_TOKEN&openid=OPENID

Parameter Description

Return instructions

Correct Json return result:

{ &lt;br/&gt;"openid":"OPENID",<br/>"nickname":"NICKNAME",<br/>"sex":1,<br/>"province":"PROVINCE",<br/>"city":"CITY",<br/>"country":"COUNTRY",<br/>"headimgurl":"http ://wx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/0",<br/>"privilege":[<br/>"PRIVILEGE1", &lt;br/&gt;"PRIVILEGE2"<br/>],<br/>"unionid": " o6_bmasdasdsad6_2sgVt7hMZOPfL"<br/><br/>}

"errcode":40003,"errmsg":"invalid openid "}<br/><br/>Call frequency limit

/*

返回  code state*/

$appid = 'wxea1xxxxxxxx20cb62';

$url = "https://open.weixin.qq.com/connect/qrconnect?appid=$appid&redirect_uri=http://zhiliaoke.com.cn/weixin.php&response_type=code&scope=snsapi_login&state=1&connect_redirect=1#wechat_redirect";

<?php

$code = $_GET['code'];

$state = $_GET['state'];//换成自己的接口信息

$appid = 'XXXXX';

$appsecret = 'XXXXX';

if (empty($code)) $this->error('授权失败');

 <br/>

$token_url = 'https://api.weixin.qq.com/sns/oauth2/access_token?appid='.$appid.'&secret='.$appsecret.'&code='.$code.'&grant_type=authorization_code';

$token = json_decode(file_get_contents($token_url));

if (isset($token->errcode)) {

    echo &#39;<h1>错误：</h1>&#39;.$token->errcode;

    echo &#39;<br/><h2>错误信息：</h2>&#39;.$token->errmsg;

    exit;

}

 <br/>

$access_token_url = 'https://api.weixin.qq.com/sns/oauth2/refresh_token?appid='.$appid.'&grant_type=refresh_token&refresh_token='.$token->refresh_token;//转成对象

$access_token = json_decode(file_get_contents($access_token_url));

if (isset($access_token->errcode)) {

    echo &#39;<h1>错误：</h1>&#39;.$access_token->errcode;

    echo &#39;<br/><h2>错误信息：</h2>&#39;.$access_token->errmsg;

    exit;

}

 <br/>

 <br/>

$user_info_url = 'https://api.weixin.qq.com/sns/userinfo?access_token='.$access_token->access_token.'&openid='.$access_token->openid.'&lang=zh_CN';//转成对象

$user_info = json_decode(file_get_contents($user_info_url));

if (isset($user_info->errcode)) {

    echo &#39;<h1>错误：</h1>&#39;.$user_info->errcode;

    echo &#39;<br/><h2>错误信息：</h2>&#39;.$user_info->errmsg;

    exit;

}

$rs =  json_decode(json_encode($user_info),true);//返回的json数组转换成array数组

//打印用户信息echo &#39;<pre class="brush:php;toolbar:false">&#39;;

 <br/>

print_r($rs);echo '

 <br/>

?>