class OAuthClient

Traits

Properties

protected int $maxOAuthResponseSize from  InteractsWithOAuthEndpoints
protected DiscoveryResult|null $discovered
protected string|null $returnTo

Methods

oAuthRequest()

Prepare a buffered OAuth request without following redirects.

resolveOAuthDestination(PendingRequest $request, string $url)

Validate and pin an OAuth endpoint within the prepared request's limits.

bool
isLocalhost(string $host)

Determine whether the normalized host names a local development endpoint.

string
normalizedHost(string $host)

Normalize the host consistently with destination validation.

__construct(OAuthConfig $config, string $resourceUrl, string|null $resourceMetadataUrl = null, string|null $challengeScope = null, AuthServerDiscovery $discovery = new AuthServerDiscovery(), string|null $clientIdMetadataUrl = null, array $resourceHeaders = [])

Create an OAuth client for the configured resource.

redirect(string|null $returnTo = null)

Redirect to the authorization server and remember the pending exchange.

clientCredentials()

Obtain a token using the configured client credentials.

exchangeCallback()

Exchange the current authorization callback for a token.

string|null
returnTo()

Get the return URL remembered by the authorization exchange.

refreshCredentials(string $refreshToken, string|null $clientId = null, string|null $clientSecret = null)

Refresh an access token using its client credentials.

exchangeAuthorizationCode(string $code, string $state, string|null $iss)

Validate and exchange the authorization code against the pending session.

bool
usesClientIdMetadataDocument(AuthServerMetadata $metadata)

Determine whether the client can identify itself through a metadata document.

bool
isPubliclyResolvable(string $host)

Determine whether a metadata document host is eligible for public discovery.

register(AuthServerMetadata $metadata, string $redirectUri)

Register a client when no configured client identifier is available.

requestToken(string $tokenEndpoint, array $params, string|null $clientId, string|null $clientSecret, TokenEndpointAuthMethod $authMethod)

Request a token using the selected client authentication method.

void
throwOnServerError()

Report an authorization error returned in the callback.

string|null
query(string $key)

Get a nonempty string from the callback query.

discover()

Discover the authorization server once for this client.

string|null
resolveScope()

Resolve the challenged or configured authorization scope.

string|null
authorizationScope()

Use advertised scopes when no authorization scope was selected.

TokenEndpointAuthMethod
resolveTokenAuthMethod(AuthServerMetadata $metadata, string|null $clientSecret)

Choose a supported authentication method for the available credentials.

string
applicationType(string $redirectUri)

Identify loopback callback applications as native clients.

void
validateIssuer(array $stored, string|null $iss)

Validate the callback issuer against the pending authorization.

string
sessionKey()

Get the session key for this client's pending authorization.

Details

protected PendingRequest oAuthRequest()

Prepare a buffered OAuth request without following redirects.

Return Value

PendingRequest

protected ResolvedDestination resolveOAuthDestination(PendingRequest $request, string $url)

Validate and pin an OAuth endpoint within the prepared request's limits.

Parameters

PendingRequest $request
string $url

Return Value

ResolvedDestination

protected bool isLocalhost(string $host)

Determine whether the normalized host names a local development endpoint.

Parameters

string $host

Return Value

bool

protected string normalizedHost(string $host)

Normalize the host consistently with destination validation.

Parameters

string $host

Return Value

string

at line 30
__construct(OAuthConfig $config, string $resourceUrl, string|null $resourceMetadataUrl = null, string|null $challengeScope = null, AuthServerDiscovery $discovery = new AuthServerDiscovery(), string|null $clientIdMetadataUrl = null, array $resourceHeaders = [])

Create an OAuth client for the configured resource.

Parameters

OAuthConfig $config
string $resourceUrl
string|null $resourceMetadataUrl
string|null $challengeScope
AuthServerDiscovery $discovery
string|null $clientIdMetadataUrl
array $resourceHeaders

at line 45
RedirectResponse redirect(string|null $returnTo = null)

Redirect to the authorization server and remember the pending exchange.

Parameters

string|null $returnTo

Return Value

RedirectResponse

at line 112
TokenSet clientCredentials()

Obtain a token using the configured client credentials.

Return Value

TokenSet

at line 136
TokenSet exchangeCallback()

Exchange the current authorization callback for a token.

Return Value

TokenSet

at line 159
string|null returnTo()

Get the return URL remembered by the authorization exchange.

Return Value

string|null

at line 167
TokenSet refreshCredentials(string $refreshToken, string|null $clientId = null, string|null $clientSecret = null)

Refresh an access token using its client credentials.

Parameters

string $refreshToken
string|null $clientId
string|null $clientSecret

Return Value

TokenSet

at line 202
protected TokenSet exchangeAuthorizationCode(string $code, string $state, string|null $iss)

Validate and exchange the authorization code against the pending session.

Parameters

string $code
string $state
string|null $iss

Return Value

TokenSet

at line 270
protected bool usesClientIdMetadataDocument(AuthServerMetadata $metadata)

Determine whether the client can identify itself through a metadata document.

Parameters

AuthServerMetadata $metadata

Return Value

bool

at line 293
protected bool isPubliclyResolvable(string $host)

Determine whether a metadata document host is eligible for public discovery.

Parameters

string $host

Return Value

bool

at line 311
protected ClientRegistration register(AuthServerMetadata $metadata, string $redirectUri)

Register a client when no configured client identifier is available.

Parameters

AuthServerMetadata $metadata
string $redirectUri

Return Value

ClientRegistration

at line 331
protected TokenSet requestToken(string $tokenEndpoint, array $params, string|null $clientId, string|null $clientSecret, TokenEndpointAuthMethod $authMethod)

Request a token using the selected client authentication method.

Parameters

string $tokenEndpoint
array $params
string|null $clientId
string|null $clientSecret
TokenEndpointAuthMethod $authMethod

Return Value

TokenSet

at line 374
protected void throwOnServerError()

Report an authorization error returned in the callback.

Return Value

void

at line 399
protected string|null query(string $key)

Get a nonempty string from the callback query.

Parameters

string $key

Return Value

string|null

at line 409
protected DiscoveryResult discover()

Discover the authorization server once for this client.

Return Value

DiscoveryResult

at line 417
protected string|null resolveScope()

Resolve the challenged or configured authorization scope.

Return Value

string|null

at line 429
protected string|null authorizationScope()

Use advertised scopes when no authorization scope was selected.

Return Value

string|null

at line 444
protected TokenEndpointAuthMethod resolveTokenAuthMethod(AuthServerMetadata $metadata, string|null $clientSecret)

Choose a supported authentication method for the available credentials.

Parameters

AuthServerMetadata $metadata
string|null $clientSecret

Return Value

TokenEndpointAuthMethod

at line 467
protected string applicationType(string $redirectUri)

Identify loopback callback applications as native clients.

Parameters

string $redirectUri

Return Value

string

at line 481
protected void validateIssuer(array $stored, string|null $iss)

Validate the callback issuer against the pending authorization.

Parameters

array $stored
string|null $iss

Return Value

void

at line 501
protected string sessionKey()

Get the session key for this client's pending authorization.

Return Value

string