A talk given at PHP London on 4th November 2010. This provides an introduction to OAuth and a simplistic PHP implementation of a consumer, as well as a few things to think about when creating a provider.

1. Using OAuth with PHP
Dave Ingram
@dmi
4th November 2010

5. Coming up
• What is OAuth?
• How do you write a Consumer in PHP?
• What doesn’t OAuth do?
• Thoughts on being a Provider

6. What is OAuth anyway?

7. A long time ago, in a website not far away. . .

10. Connect!

11. Connect!
U:KittehLuvr
P:hunter2

12. Connect!
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2

13. Connect!
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2

14. Connect!
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2

15. Connect!
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2
U:KittehLuvr
P:hunter2
O HAI TWITTER
LOOK AT MAH
KITTEH LOL!

16. Full access

17. Full access
Fragile

18. Full access
Fragile
Revoking is painful

19. YOU REVEAL YOUR USERNAME
AND PASSWORD

20. YOUR USERNAME
AND PASSWORD

22. Who uses it?

34. Building a Consumer

35. To sign requests, you need:
Consumer key
Consumer secret
(Unique per application)
+
Access token
Access secret
(Unique per application user)

36. Step 1: Register with the provider

37. I would like my OAuth
application to
consume your service
please, Mr. Provider.

38. Certainly. I just need
to take a few details
from you, and we’ll be
all set.

39. OK. Here you go.

40. Consumer key
Consumer secret

41. Step 2: Write your application
Step 3: ??????
Step 4: Profit!

42. Step 2: Write your application
Step 3: ??????
Step 4: Profit!

43. User Consumer Provider
User clicks connect

44. User Consumer Provider
C C
Ask provider for
request token

45. User Consumer Provider
C C
R R
Provider returns
request token and
request secret

46. User Consumer Provider
C C
R R
R
Redirect user to provider

47. User Consumer Provider
C C
R R
R
R
User logs in/authorises
app

48. User Consumer Provider
C C
R R
R
R
V
Provider redirects user
back to app with
verifier

49. User Consumer Provider
C C
R R
R
R
V
V
User’s arrival with
verifier notifies app

50. User Consumer Provider
C C
R R
R
R
V
V
C C R R V
App then exchanges
request token for
access token

51. User Consumer Provider
C C
R R
R
R
V
V
C C R R V
A A
Provider returns
access token and
access secret

52. User Consumer Provider
C C
R R
R
R
V
V
C C R R V
A A
C C A A
App makes request on
user’s behalf

53. Get request token
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY,
MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1,
);

54. Get request token
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY,
MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1,
);
// Fetch the request token
$response = $o->getRequestToken(
'https://api.twitter.com/oauth/request_token'
);
// Save for later exchange
$_SESSION['req_token'] = $response['oauth_token'];
$_SESSION['req_secret'] = $response['oauth_token_secret'];

55. Get request token
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY,
MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1,
);
// Fetch the request token
$response = $o->getRequestToken(
'https://api.twitter.com/oauth/request_token'
);
// Save for later exchange
$_SESSION['req_token'] = $response['oauth_token'];
$_SESSION['req_secret'] = $response['oauth_token_secret'];
// Send user to provider's site
header('Location: https://api.twitter.com/oauth/authorize'.
'?oauth_token='.$response['oauth_token']);

57. Get access token
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY, MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1
);
// Sign requests with the request token
$o->setToken($_SESSION['req_token'], $_SESSION['req_secret']);

58. Get access token
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY, MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1
);
// Sign requests with the request token
$o->setToken($_SESSION['req_token'], $_SESSION['req_secret']);
// Exchange request for access token (verifier is automatic)
$response = $o->getAccessToken(
'https://api.twitter.com/oauth/access_token'
);
// Save access tokens for later use
$current_user->saveTwitterTokens(
$response['oauth_token'],
$response['oauth_token_secret'],
);
header('Location: /twitter-link-ok');

59. Access token
Access secret

60. Make API requests
// Create OAuth client object
$o = new OAuth(
MY_CONSUMER_KEY, MY_CONSUMER_SECRET,
OAUTH_SIG_METHOD_HMACSHA1
);
// Sign requests with the access token
$o->setToken(
$current_user->getTwitterToken(),
$current_user->getTwitterSecret()
);
$args = array('status'=>'O HAI TWITTER LOOK AT MAH KITTEH LOL!');
$oauth->fetch(
'https://api.twitter.com/v1/statuses/update.json',
$args,
OAUTH_HTTP_METHOD_POST
);
$json = json_decode($oauth->getLastResponse());
printf("Result: %sn", print_r($json, true));

61. What OAuth doesn’t do

62. No proof of server identity (use TLS)

63. No proof of server identity (use TLS)
No confidentiality (use TLS/SSL)

64. No proof of server identity (use TLS)
No confidentiality (use TLS/SSL)
No open-source consumer

65. Thoughts on being a
Provider

66. Very easy to be a Consumer

67. Very easy to be a Consumer
Many design decisions to make as a Provider

68. Very easy to be a Consumer
Many design decisions to make as a Provider
A fair amount of work, and not always easy to change
your mind

69. Very easy to be a Consumer
Many design decisions to make as a Provider
A fair amount of work, and not always easy to change
your mind
For example. . .

70. How large a range of timestamps do you allow?

71. How large a range of timestamps do you allow?
What permission granularity do you provide?

72. How large a range of timestamps do you allow?
What permission granularity do you provide?
What format and length are tokens/secrets?

73. How large a range of timestamps do you allow?
What permission granularity do you provide?
What format and length are tokens/secrets?
Do you identify actions as coming from particular
consumers? (e.g. Twitter)

74. How large a range of timestamps do you allow?
What permission granularity do you provide?
What format and length are tokens/secrets?
Do you identify actions as coming from particular
consumers? (e.g. Twitter)
What about attacks? Phishing, DoS, clickjacking, CSRF

75. How large a range of timestamps do you allow?
What permission granularity do you provide?
What format and length are tokens/secrets?
Do you identify actions as coming from particular
consumers? (e.g. Twitter)
What about attacks? Phishing, DoS, clickjacking, CSRF
Beware proxying/caching (use the right headers!)

76. Links
OAuth Spec: http://oauth.net/
Intro/tutorial: http://hueniverse.com/
PECL extension: http://pecl.php.net/oauth/
Me: http://twitter.com/dmi
http://www.dmi.me.uk/talks/
http://www.dmi.me.uk/code/php/
Slides: http://slideshare.net/ingramd