API を保護するために PHP に OAuth 2.0 を統合する方法

composer require league/oauth2-client

<?php

require 'vendor/autoload.php';

use LeagueOAuth2ClientProviderGithub;

const CLIENT_ID = 'your_client_id';
const CLIENT_SECRET = 'your_client_secret';
const REDIRECT_URI = 'http://localhost/oauth2/callback.php';

$provider = new Github([
    'clientId'        => CLIENT_ID,
    'clientSecret'    => CLIENT_SECRET,
    'redirectUri'     => REDIRECT_URI,
]);

<?php

$authorizationUrl = $provider->getAuthorizationUrl([
    'scope' => ['user', 'repo', 'notifications']
]);

$_SESSION['oauth2state'] = $provider->getState();

header('Location: ' . $authorizationUrl);

<?php

if (isset($_GET['code']) && isset($_GET['state']) && isset($_SESSION['oauth2state'])) {
    if ($_GET['state'] === $_SESSION['oauth2state']) {

        try {
            $token = $provider->getAccessToken('authorization_code', [
                'code' => $_GET['code']
            ]);

            $accessToken = $token->getToken();
            $refreshToken = $token->getRefreshToken();
            $expires = $token->getExpires();
        } catch (Exception $e) {
            exit('Failed to get access token: ' . $e->getMessage());
        }

        // Get the user object.
        try {
            $user = $provider->getResourceOwner($token);
            $name = $user->getName();
            $email = $user->getEmail();
            $imageUrl = $user->getAvatarUrl();
            $profileUrl = $user->getHtmlUrl();
        } catch (Exception $e) {
            exit('Failed to get user: ' . $e->getMessage());
        }

        // Store the access token and user data somewhere
        // for use in your application.
        $_SESSION['github_access_token'] = $accessToken;
        $_SESSION['github_refresh_token'] = $refreshToken;
        $_SESSION['github_expires'] = $expires;
        $_SESSION['github_user_name'] = $name;
        $_SESSION['github_user_email'] = $email;
        $_SESSION['github_user_image'] = $imageUrl;
        $_SESSION['github_user_profile_url'] = $profileUrl;

        // Redirect the user to the original page
        // or some other authorized page in your application.
        header('Location: /');
        exit();
    } else {
        exit('Invalid state');
    }
}

<?php

$client = new GuzzleHttpClient();

$response = $client->request('GET', 'https://api.github.com/user', [
    'headers' => [
        'Authorization' => 'Bearer ' . $_SESSION['github_access_token'],
        'User-Agent' => 'OAuth2 Client'
    ]
]);

$body = $response->getBody();
$userData = json_decode($body, true);