diff options
author | Mario Vavti <mario@mariovavti.com> | 2017-03-20 08:53:08 +0100 |
---|---|---|
committer | Mario Vavti <mario@mariovavti.com> | 2017-03-20 08:53:08 +0100 |
commit | b10c519cc16ac7cc115becd19bc8eeb3ee2e4c38 (patch) | |
tree | 303a49bd4e386ea8895e07c31f826b15f711ae27 /vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php | |
parent | 2f3f95d3a9473d4b9c15727c960f51026c992094 (diff) | |
parent | 1bdab6e633fd023432ed86ad898da1fe4ddc470f (diff) | |
download | volse-hubzilla-b10c519cc16ac7cc115becd19bc8eeb3ee2e4c38.tar.gz volse-hubzilla-b10c519cc16ac7cc115becd19bc8eeb3ee2e4c38.tar.bz2 volse-hubzilla-b10c519cc16ac7cc115becd19bc8eeb3ee2e4c38.zip |
Merge branch 'dev' into bs4
Diffstat (limited to 'vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php')
-rw-r--r-- | vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php | 123 |
1 files changed, 123 insertions, 0 deletions
diff --git a/vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php b/vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php new file mode 100644 index 000000000..0ecb7e18d --- /dev/null +++ b/vendor/bshaffer/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php @@ -0,0 +1,123 @@ +<?php + +namespace OAuth2\ClientAssertionType; + +use OAuth2\Storage\ClientCredentialsInterface; +use OAuth2\RequestInterface; +use OAuth2\ResponseInterface; + +/** + * Validate a client via Http Basic authentication + * + * @author Brent Shaffer <bshafs at gmail dot com> + */ +class HttpBasic implements ClientAssertionTypeInterface +{ + private $clientData; + + protected $storage; + protected $config; + + /** + * @param OAuth2\Storage\ClientCredentialsInterface $clientStorage REQUIRED Storage class for retrieving client credentials information + * @param array $config OPTIONAL Configuration options for the server + * <code> + * $config = array( + * 'allow_credentials_in_request_body' => true, // whether to look for credentials in the POST body in addition to the Authorize HTTP Header + * 'allow_public_clients' => true // if true, "public clients" (clients without a secret) may be authenticated + * ); + * </code> + */ + public function __construct(ClientCredentialsInterface $storage, array $config = array()) + { + $this->storage = $storage; + $this->config = array_merge(array( + 'allow_credentials_in_request_body' => true, + 'allow_public_clients' => true, + ), $config); + } + + public function validateRequest(RequestInterface $request, ResponseInterface $response) + { + if (!$clientData = $this->getClientCredentials($request, $response)) { + return false; + } + + if (!isset($clientData['client_id'])) { + throw new \LogicException('the clientData array must have "client_id" set'); + } + + if (!isset($clientData['client_secret']) || $clientData['client_secret'] == '') { + if (!$this->config['allow_public_clients']) { + $response->setError(400, 'invalid_client', 'client credentials are required'); + + return false; + } + + if (!$this->storage->isPublicClient($clientData['client_id'])) { + $response->setError(400, 'invalid_client', 'This client is invalid or must authenticate using a client secret'); + + return false; + } + } elseif ($this->storage->checkClientCredentials($clientData['client_id'], $clientData['client_secret']) === false) { + $response->setError(400, 'invalid_client', 'The client credentials are invalid'); + + return false; + } + + $this->clientData = $clientData; + + return true; + } + + public function getClientId() + { + return $this->clientData['client_id']; + } + + /** + * Internal function used to get the client credentials from HTTP basic + * auth or POST data. + * + * According to the spec (draft 20), the client_id can be provided in + * the Basic Authorization header (recommended) or via GET/POST. + * + * @return + * A list containing the client identifier and password, for example + * @code + * return array( + * "client_id" => CLIENT_ID, // REQUIRED the client id + * "client_secret" => CLIENT_SECRET, // OPTIONAL the client secret (may be omitted for public clients) + * ); + * @endcode + * + * @see http://tools.ietf.org/html/rfc6749#section-2.3.1 + * + * @ingroup oauth2_section_2 + */ + public function getClientCredentials(RequestInterface $request, ResponseInterface $response = null) + { + if (!is_null($request->headers('PHP_AUTH_USER')) && !is_null($request->headers('PHP_AUTH_PW'))) { + return array('client_id' => $request->headers('PHP_AUTH_USER'), 'client_secret' => $request->headers('PHP_AUTH_PW')); + } + + if ($this->config['allow_credentials_in_request_body']) { + // Using POST for HttpBasic authorization is not recommended, but is supported by specification + if (!is_null($request->request('client_id'))) { + /** + * client_secret can be null if the client's password is an empty string + * @see http://tools.ietf.org/html/rfc6749#section-2.3.1 + */ + + return array('client_id' => $request->request('client_id'), 'client_secret' => $request->request('client_secret')); + } + } + + if ($response) { + $message = $this->config['allow_credentials_in_request_body'] ? ' or body' : ''; + $response->setError(400, 'invalid_client', 'Client credentials were not found in the headers'.$message); + } + + return null; + } +} |