OAuth 2.0 or is it OAuth Wrap

When it comes to beating out social standards for Authorisation and Delegation Facebook and a group of others have highjacked the "OAuth" name and devised OAuth 2.... even though it has none of the cryptography of OAuth But its more like the other OAuth imposter OAUTH WRAP in every way but nomenclatures... aka they un"wrap"ed it!

Not wanting to follow FB's convoluted example i modified my OAuth Wrap client, and it posted below..

DEMO

http://sandbox.knarly.com/oauth/oauth2.php

CODE

<?php
/**
 * This script makes a connection to a oauth server at Facebook
 * 
 * @author Andrew Dodson
 * @since June 2010
 * @company Knarly Ltd (knarly.com)
 */

$oauths=array(
	'facebook' => array(
		'path'	=> "https://graph.facebook.com/oauth/access_token",
		'login'	=> 'https://graph.facebook.com/oauth/authorize',
		'key'	=> '359288236870',
		'secret'=> 'put-you-secret-here',
		'datamine' => 'https://graph.facebook.com/me?'
	),
);


if( ( $srv = @$oauths[@$_GET['service']] ) ){
	
	// if this is the first time the user has connected
	if(empty($_GET['code'])){
		redirect( $srv['login'], (array(
			'client_id' => $srv['key'],
			'redirect_uri'	=> "http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'],
		)));
	}
	else if(!empty($_GET['code'])){
		// else check that the wrap_verification_code came from the server we're interrogating
		// Can't use http_build_query because that encodes '|' which appears in the wrap_verification_code
		try{
			$resp = _get( $srv['path'] , array(
				'client_id'		=> $srv['key'],
				'client_secret'	=> $srv['secret'],
				'redirect_uri'	=> urlencode("http://".$_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME'].'?service='.$_GET['service']),
				'code'			=> urldecode($_GET['code']),
			));

			// Datamine
			// Return the default contents
			$_GET += $resp;
		 	r("RESPONSE", $resp);

		 }catch(Exception $e){
		 	r("Failed to load", $e);
		 }
	}
	
	/**
	 * Check it works!
	 */
	if(!empty($_REQUEST['access_token'])){
		$user = file_get_contents( $srv['datamine'] .'access_token=' . $_REQUEST['access_token'] );
		r( json_decode($user) );
	}
}

// Print to screen a bit of info
function r(){
	print "<pre>".print_r(func_get_args(),true)."</pre>";
}

// This redirect the user... in production this would not be a link but a header('Location: '.$path);
function redirect($u,$p){
	print "<a href='$u?". http_build_query($p) . "'>Login at $u</a> | ";
}


// GUI
// PRINT ALL THE OAUTH SERVICES TO THE SCREEN
foreach($oauths as $k => $o){
	print ' | <a href="'.$_SERVER['SCRIPT_NAME'].'?service='.$k.'">'.$k.'</a>';
}

function implode_with_key($a){
	$r=array();
	foreach($a as $k=>$o)
		$r[] = $k.'='.$o;
	return implode('&',$r);
}

function _get($path, $opts){
	$resp = file_get_contents( $path . '?' . implode_with_key($opts) );
	parse_str($resp , $resp );
	return $resp ;
}
?>

Edit Article

Comments

	Title* Comment Prove you are not a robot To prove you are not a robot, please type in the six character code you see in the picture below I can't see this! Contact Name* Email never shown* Home Page Send