diff --git a/auth-server-password.md b/auth-server-password.md index 2599473d..24d97280 100755 --- a/auth-server-password.md +++ b/auth-server-password.md @@ -22,6 +22,8 @@ $passwordGrant = new \League\OAuth2\Server\Grant\PasswordGrant(); $passwordGrant->setVerifyCredentialsCallback(function ($username, $password) { // implement logic here to validate a username and password, return an ID if valid, otherwise return false }); + +$server->addGrantType($passwordGrant); ~~~ @@ -37,7 +39,7 @@ $router->post('/access_token', function (Request $request) use ($server) { $response = $server->issueAccessToken(); return new Response( json_encode($response), - 200 + 200, [ 'Content-type' => 'application/json', 'Cache-Control' => 'no-store', @@ -59,4 +61,4 @@ $router->post('/access_token', function (Request $request) use ($server) { } }); -~~~ \ No newline at end of file +~~~ diff --git a/auth-server-which-grant.md b/auth-server-which-grant.md index 263ffa0e..0d138654 100755 --- a/auth-server-which-grant.md +++ b/auth-server-which-grant.md @@ -90,7 +90,7 @@ This grant is suitable for trusted clients such as a service’s own mobile clie ~~~ php $clientCredentials = new League\OAuth2\Server\Grant\ClientCredentialsGrant(); -server->addGrantType($clientCredentials); +$server->addGrantType($clientCredentials); ~~~ This grant is similar to the resource owner credentials grant except only the client’s credentials are used to authenticate a request for an access token. Again this grant should only be allowed to be used by trusted clients. @@ -112,4 +112,4 @@ The OAuth 2.0 specification also details a fifth grant which can be used to “r Authorisation servers which support this grant will also issue a “refresh token” when it returns an access token to a client. When the access token expires instead of sending the user back through the authorisation code grant the client can use to the refresh token to retrieve a new access token with the same permissions as the old one. -A problem with the grant is that it means the client has to maintain state of each token and then either on a cron job keep access tokens up to date or when it tries to make a request and it fails then go and update the access token and repeat the request. \ No newline at end of file +A problem with the grant is that it means the client has to maintain state of each token and then either on a cron job keep access tokens up to date or when it tries to make a request and it fails then go and update the access token and repeat the request.