groton-school/slim-oauth2-api-proxy

Server-side actions and routes for authenticating to and accessing an REST API from a web client

1.0.0 2025-08-16 23:42 UTC

Requires

• dflydev/fig-cookies: dev-feat/chips
• groton-school/oauth2-canvaslms: ^1.1
• groton-school/slim-norms: ^1.0
• league/oauth2-client: ^2.8
• league/uri: ^7.5
• odan/session: ^6.4
• php-di/php-di: ^7.0
• psr/container: ^2.0
• psr/http-message: ^2.0
• slim/http: ^1.4
• slim/slim: ^4.12

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.76
• marcocesarato/php-conventional-changelog: ^1.17

GPL-3.0

• Seth Battis

README

Server-side actions and routes for authenticating to and accessing an REST API from a web client

Install

composer require groton-school/oauth2-api-proxy

Use

Due to CORS restrictions, a web app can't directly access an arbitrary REST API. This package provides a server-side proxy for the web client to use to access the REST API, storing the the user's API access tokens on the client side as web cookies.

1. Implement ProviderInterface. This is intended to be done with one of the League/oauth2-client implementations. See groton-school/slim-canvas-api-proxy for a concrete example (which makes use of the Defaults traits provided for convenience).
2. Inject the implementation as a dependency. (Of course, make sure that you store your API credentials somewhere secure!)
3. use RouteBuilder to define the necessary routes.
4. Access the client from a web app. A concrete example of this is @groton/canvas-api.client.web.

groton-school/slim-skeleton@dev-gae/lti-tool_canvas-api-proxy

groton-school/slim-skeleton is the canonical example of how this shim is meant to be used.