1
|
|
|
<?php |
2
|
|
|
/** |
3
|
|
|
* Created by PhpStorm. |
4
|
|
|
* User: Alexandre |
5
|
|
|
* Date: 27/05/2018 |
6
|
|
|
* Time: 18:13 |
7
|
|
|
*/ |
8
|
|
|
|
9
|
|
|
namespace OAuth2\Roles\ResourceServer\BearerAuthenticationMethods; |
10
|
|
|
use Psr\Http\Message\ServerRequestInterface; |
11
|
|
|
|
12
|
|
|
/** |
13
|
|
|
* Class FormEncodedBodyParameter |
14
|
|
|
* @package OAuth2\Roles\ResourceServer\BearerAuthenticationMethods |
15
|
|
|
* |
16
|
|
|
* @see https://tools.ietf.org/html/rfc6750#section-2.2 |
17
|
|
|
* When sending the access token in the HTTP request entity-body, the |
18
|
|
|
* client adds the access token to the request-body using the |
19
|
|
|
* "access_token" parameter. The client MUST NOT use this method unless |
20
|
|
|
* all of the following conditions are met: |
21
|
|
|
* |
22
|
|
|
* o The HTTP request entity-header includes the "Content-Type" header |
23
|
|
|
* field set to "application/x-www-form-urlencoded". |
24
|
|
|
* |
25
|
|
|
* o The entity-body follows the encoding requirements of the |
26
|
|
|
* "application/x-www-form-urlencoded" content-type as defined by |
27
|
|
|
* HTML 4.01 [W3C.REC-html401-19991224]. |
28
|
|
|
* |
29
|
|
|
* o The HTTP request entity-body is single-part. |
30
|
|
|
* |
31
|
|
|
* o The content to be encoded in the entity-body MUST consist entirely |
32
|
|
|
* of ASCII [USASCII] characters. |
33
|
|
|
* |
34
|
|
|
* o The HTTP request method is one for which the request-body has |
35
|
|
|
* defined semantics. In particular, this means that the "GET" |
36
|
|
|
* method MUST NOT be used. |
37
|
|
|
* |
38
|
|
|
* The entity-body MAY include other request-specific parameters, in |
39
|
|
|
* which case the "access_token" parameter MUST be properly separated |
40
|
|
|
* from the request-specific parameters using "&" character(s) (ASCII |
41
|
|
|
* code 38). |
42
|
|
|
* |
43
|
|
|
* For example, the client makes the following HTTP request using |
44
|
|
|
* transport-layer security: |
45
|
|
|
* |
46
|
|
|
* POST /resource HTTP/1.1 |
47
|
|
|
* Host: server.example.com |
48
|
|
|
* Content-Type: application/x-www-form-urlencoded |
49
|
|
|
* |
50
|
|
|
* access_token=mF_9.B5f-4.1JqM |
51
|
|
|
* |
52
|
|
|
* The "application/x-www-form-urlencoded" method SHOULD NOT be used |
53
|
|
|
* except in application contexts where participating browsers do not |
54
|
|
|
* have access to the "Authorization" request header field. Resource |
55
|
|
|
* servers MAY support this method. |
56
|
|
|
*/ |
57
|
|
|
class FormEncodedBodyParameter implements BearerAuthenticationMethodInterface |
58
|
|
|
{ |
59
|
|
|
public function support(ServerRequestInterface $request): bool |
60
|
|
|
{ |
61
|
|
|
|
62
|
|
|
} |
|
|
|
|
63
|
|
|
|
64
|
|
|
public function authenticate(ServerRequestInterface $request): ?string |
65
|
|
|
{ |
66
|
|
|
|
67
|
|
|
} |
68
|
|
|
} |
For hinted functions/methods where all return statements with the correct type are only reachable via conditions, ?null? gets implicitly returned which may be incompatible with the hinted type. Let?s take a look at an example: