Very simple OAuth 2.0 client
This is a very simple to use OAuth 2.0 client. It has minimal dependencies.
NOTE: if you are not bound to PHP 5.4, you are probably better off using the OAuth 2.0 client of the League of Extraordinary Packages! It can be found here.
- Works with PHP >= 5.4
- Minimal dependencies;
- Supports OAuth refresh tokens.
- Easy integration with your own application and/or framework;
- Does not enforce a framework on you;
- Only "authorization code" profile support, will not implement anything else;
- Only conforming OAuth 2.0 servers will work, this library will not get out of its way to deal with services that violate the OAuth 2.0 RFC;
- There will be no toggles to shoot yourself in the foot;
paragonie/constant_time_encodingfor constant time encoding;
paragonie/random_compatpolyfill for CSPRNG;
psr/logto provide an interface to log HTTP requests between OAuth client and server; usually very hard to debug "in the field";
You MUST configure PHP in such a way that it enforces secure cookies! See this resource for more information.
The API is very simple to use. See the
example/ folder for a working example!
As always, make sure you understand what you are doing! Some resources:
- The Fast Track to Safe and Secure PHP Sessions
- The OAuth 2.0 Authorization Framework
- The OAuth 2.0 Authorization Framework: Bearer Token Usage
- OAuth 2.0 Threat Model and Security Considerations
- Proof Key for Code Exchange by OAuth Public Clients