b88ef82563
1) The method returned the wrong result in case when the access token itself contained the string "Bearer". 2) When using cURL, the request is sometimes send twice (in my case when the first request returned a 404 error), and the Authorization header of the second request is doubled, so that you get a "Authorization: Bearer XXX, Bearer XXX". This case is checked now. (BTW: Tested with the current PHP version 5.4.15 on Windows.) |
||
|---|---|---|
| sql | ||
| src/League/OAuth2/Server | ||
| tests | ||
| .gitattributes | ||
| .gitignore | ||
| .travis.yml | ||
| build.xml | ||
| CHANGELOG.md | ||
| composer.json | ||
| license.txt | ||
| phpunit.xml | ||
| README.md | ||
The League of Extraordinary Packages presents: PHP OAuth 2.0 Server
The goal of this project is to develop a standards compliant OAuth 2.0 authorization server and resource server.
Package Installation
The framework is provided as a Composer package which can be installed by adding the package to your composer.json file:
{
"require": {
"league/oauth2-server": "2.*"
}
}
The library features 100% unit test code coverage. To run the tests yourself run phpunit from the project root.
Current Features
Authorization Server
The authorization server is a flexible class and the following core specification grants are implemented:
- authorization code (section 4.1)
- refresh token (section 6)
- client credentials (section 2.3.1)
- password (user credentials) (section 4.3)
An overview of the different OAuth 2.0 grants can be found in the wiki https://github.com/php-loep/oauth2-server/wiki/Which-OAuth-2.0-grant-should-I-use%3F.
Resource Server
The resource server allows you to secure your API endpoints by checking for a valid OAuth access token in the request and ensuring the token has the correct scope(s) (i.e. permissions) to access resources.
Custom grants
Custom grants can be created easily by implementing an interface. Check out a guide here https://github.com/php-loep/oauth2-server/wiki/Creating-custom-grants.
PDO driver
If you are using MySQL and want to very quickly implement the library then all of the storage interfaces have been implemented with PDO classes. Check out the guide here https://github.com/php-loep/oauth2-server/wiki/Using-the-PDO-storage-classes.
Tutorials and documentation
The wiki has lots of guides on how to use this library, check it out - https://github.com/php-loep/oauth2-server/wiki.
A tutorial on how to use the authorization server can be found on the wiki - (https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server)[https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server].
A tutorial on how to use the resource server to secure an API server can be found at https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0.
Future Goals
Authorization Server
- Support for JSON web tokens.
- Support for SAML assertions.
The initial code was developed as part of the Linkey project which was funded by JISC under the Access and Identity Management programme.
This code is principally developed and maintained by @alexbilbie.
A list of contributors can be found at https://github.com/php-loep/oauth2-server/contributors.