PHP が OAuth2.0 認証および認可メカニズムを実装して Web サイトのセキュリティを強化する方法

composer require bshaffer/oauth2-server-php

CREATE TABLE `users` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(255) NOT NULL,
  `password` varchar(255) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE `oauth_clients` (
  `client_id` varchar(80) NOT NULL,
  `client_secret` varchar(80) NOT NULL,
  `redirect_uri` varchar(2000) NOT NULL,
  PRIMARY KEY (`client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE `oauth_access_tokens` (
  `access_token` varchar(40) NOT NULL,
  `client_id` varchar(80) NOT NULL,
  `user_id` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`access_token`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE `oauth_refresh_tokens` (
  `access_token` varchar(40) NOT NULL,
  `client_id` varchar(80) NOT NULL,
  `user_id` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`access_token`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE `oauth_scopes` (
  `scope` varchar(80) NOT NULL,
  `is_default` tinyint(1) DEFAULT NULL,
  PRIMARY KEY (`scope`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE `oauth_jwt` (
  `client_id` varchar(80) NOT NULL,
  `subject` varchar(80) DEFAULT NULL,
  `public_key` varchar(2000) DEFAULT NULL,
  PRIMARY KEY (`client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

$config = [
    'dsn' => 'mysql:dbname=oauth2;host=localhost',
    'username' => 'root',
    'password' => 'password',
    'auth_client_secret' => 'secret-key',
    'auth_user_table' => 'users',
    'auth_client_table' => 'oauth_clients',
    'auth_token_table' => 'oauth_access_tokens',
    'auth_scope_table' => 'oauth_scopes',
];

use OAuth2StoragePdo;

class OAuth2Controller extends PhalconMvcController
{  
    public function authorizeAction()
    {
        // 创建此控制器的实例
        $server = $this->getOAuthServer();
        // 处理授权请求
        $response = new OAuth2HttpFoundationBridgeResponse();
        if (!$server->validateAuthorizeRequest(OAuth2HttpFoundationBridgeRequest::createFromGlobals(), $response)) {
            return $this->response->setContent(json_encode(['status' => 'fail', 'message' => '授权失败']));
        }
        if ($this->request->isPost()) {
            $is_authorized = (bool) $this->request->getPost('authorized', '');
            $server->handleAuthorizeRequest(OAuth2HttpFoundationBridgeRequest::createFromGlobals(), $response, $is_authorized);
            return $response;
        }
        // 显示授权页面
        return $this->view->render('oauth', 'authorize');
    }

    public function tokenAction()
    {
        // 创建此控制器的实例
        $server = $this->getOAuthServer();
        // 处理访问令牌请求
        $response = new OAuth2HttpFoundationBridgeResponse();
        $server->handleTokenRequest(OAuth2HttpFoundationBridgeRequest::createFromGlobals(), $response);
        return $response;
    }

    public function refreshAction()
    {
        // 创建此控制器的实例
        $server = $this->getOAuthServer();
        // 处理刷新令牌请求
        $response = new OAuth2HttpFoundationBridgeResponse();
        $server->handleTokenRequest(OAuth2HttpFoundationBridgeRequest::createFromGlobals(), $response);
        return $response;
    }

    protected function getOAuthServer()
    {
        // 获取连接信息
        $config = $this->config->OAuth2;
        $dsn = $config->dsn;
        $username = $config->username;
        $password = $config->password;
        $pdo = new PDO($dsn, $username, $password);
        $pdoStorage = new OAuth2StoragePdo($pdo, [
            'user_table' => $config->auth_user_table,
            'client_table' => $config->auth_client_table,
            'access_token_table' => $config->auth_token_table,
            'scope_table' => $config->auth_scope_table,
        ]);
        // 创建OAuth2.0服务器实例
        $server = new OAuth2Server($pdoStorage);
        // 配置客户端身份验证
        $server->addGrantType(new OAuth2GrantTypeClientCredentials($pdoStorage));
        // 配置用户身份验证
        $server->addGrantType(new OAuth2GrantTypeUserCredentials($pdoStorage));
        return $server;
    }
}