OAuth


OAuth 2.0 framework to consume Google API service.....



What is OAuth ??


OAuth (Open Authorization) is an open protocol that provides secure API authorization from applications in a simple and standardized way. OAuth can authorize access to resources without revealing user credentials to apps. Apps that use OAuth can also directly authenticate and access Sales-force resources without a user’s presence

OAuth is sometimes described as a valet key for the web. A valet key restricts access to a car. A person can drive it, but can’t use the key to open the trunk or glove box. In the same way, OAuth gives a client application restricted access to your data on a resource server. To allow access, an authorization server grants tokens to the client app in response to an authorization.



How to use it to store a file in Google Drive?


First things first, You will need OAuth 2.0 client credentials from Google API. Then your client application requests an access token from the Google Authorization Server, extracts a token from the response, and sends the token to the Google API that you want to access. To do this first you have to,

  • Then Select the project and navigate to credentials, under create credentials go to “OAuth Client ID” and Create a web application
  • When you create the application, it will ask for a redirect URL. That’s where you have to put your website (In this example, Localhost) authentication controller endpoint.


So for my example I have used the redirect URI as following



  • And another most important part is you have to give a name to your application. Otherwise it won’t allow you to create a OAuth Client ID. You can give a name to your Application under OAuth consent screen.


When you successfully create a OAuth client ID you will get two important keys.
  1. Client ID
  2. Client Secret
Now Google API part is done.  Let’s do some coding where we can use the client ID to access some resources from Google, such as Google Drive.

We will be using PHP to access the Google Resources. So to make those easy Google has given us a library where all the necessary attributes and methods include. That is called Google APIs Client Library for PHP

I have download the library release from GitHub and put into my project folder.



Now you have the library so, then you can  create a json file to store all the Google API credentials.




In the above snapshot of the json file you have to fill out the blacked spaces with your own credentials that you have got from the Google Client ID.
Also for the redirect URI you have to provide the exact same Redirect URI you have provided when you create the Client ID.
Okay. You have the Json file now. Let’s go deeper.
Create a small form so you can call the authenticate.php file

authenticate.php will let you get access to the google resources by letting you authenticate yourself from the google account credentials and generate a token by giving access to the google drive.

When you successfully get redirected to the same authenticate.php from the OAuth client ID Application with a token which has access to google Drive we have to save it in our session to use it when we upload files.
Now you can get redirected to a page where you can select files and submit the file to another php file, in here it’s upload_to_drive.php

And when you submit the file, it will call the upload_to_drive.php.


 Here we will get access to the google drive from the token we have saved in our session and upload the selected file. Once done and successful we can redirect to a success page.
All the source codes for above example project can be found here. I hope you got some idea about how to use OAuth in PHP.


Comments

Post a Comment

Popular posts from this blog

Image
How to link WebStorm IDE with GitHub windows application The main advantage of link WebStrom with GitHub windows application is you can do the version controlling directly through the WebStorm IDE. When you are doing a project  using WebStorm IDE you can use git command which are use to version controlling in the IDE it self, if you have linked with GitHub windows application. Now will see how to link WebStorm IDE with GitHub windows application.. step 1) Install WebStorm IDE. step 2) install GitHub windows application and clone with the project which is  in the GitHub or GitLab repository. step 3) Open that project using WebStorm. IF you have done those three step already follow these steps to link WebStorm and GitHub windows application. step 4) Go to this file path and copy it.           C drive -> Users -> <your user file> -> Appdata -> Local ->            GitHub ->   PortableGit_f02737a78695063deace08e96d50
Read more

Assignments and Grades integration in Moodle LMS - LTI 1.3 (With client_credentials base OAuth 2.0)

Image
Moodle is the world’s most popular and most used learning management system. It’s easy to see why, the Moodle Learning Management System (LMS) is a flexible, open-source, and free to download learning management solution. This article describes how we need to work with moodle APIs in order to manipulate assignments and grades. These details are specific to LTI 1.3 standards and using client credential base OAuth 2.0 In LTI 1.3 flow, the main part is OAuth 2.0. When we work with moodle APIs, it needs to send the access token along with each API call. That means before work with the end-points we have to have the access token with us. This article specifies the client credential base assess token and to get that access token we need an external tool in Moodle LMS.  Let's see the process step by step....  This process can be divided into three parts.  Create an external tool in Moodle.  Generate access token. Manipulate assignments and grade APIs.  1) Create an external tool in Moodle
Read more

Cross Site Request Forgery Protection

Image
Cross Site Request Forgery Protection PHP web application What is CSRF (Cross Site Request Forgery protection) ?  Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. In this blog I will be discuss about two prevention methods for CSRF.        
Read more