Laravel Passport——OAuth2 API 认证系统源码解析（下）

隐式授权

隐式授权类似于授权码授权，但是它只令牌将返回给客户端而不交换授权码。这种授权最常用于无法安全存储客户端凭据的 JavaScript 或移动应用程序。通过调用 AuthServiceProvider 中的 enableImplicitGrant 方法来启用这种授权：

  1. public function boot()
  2. {
  3.     $this->registerPolicies();
  5.     Passport::routes();
  7.     Passport::enableImplicitGrant();
  8. }

调用上面方法开启授权后，开发者可以使用他们的客户端 ID 从应用程序请求访问令牌。接入的应用程序应该向你的应用程序的 /oauth/authorize 路由发出重定向请求，如下所示：

  1. Route::get('/redirect', function () {
  2.     $query = http_build_query([
  3.         'client_id' => 'client-id',
  4.         'redirect_uri' => 'http://example.com/callback',
  5.         'response_type' => 'token',
  6.         'scope' => '',
  7.     ]);
  9.     return redirect('http://your-app.com/oauth/authorize?'.$query);
  10. });

首先仍然是验证授权请求的合法性，其流程与授权码模式基本一致：

  1. public function validateAuthorizationRequest(ServerRequestInterface $request)
  2. {
  3.     $clientId = $this->getQueryStringParameter(
  4.         'client_id',
  5.         $request,
  6.         $this->getServerParameter('PHP_AUTH_USER', $request)
  7.     );
  8.     if (is_null($clientId)) {
  9.         throw OAuthServerException::invalidRequest('client_id');
  10.     }
  12.     $client = $this->clientRepository->getClientEntity(
  13.         $clientId,
  14.         $this->getIdentifier(),
  15.         null,
  16.         false
  17.     );
  19.     if ($client instanceof ClientEntityInterface === false) {
  20.         $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
  21.         throw OAuthServerException::invalidClient();
  22.     }
  24.     $redirectUri = $this->getQueryStringParameter('redirect_uri', $request);
  26.     $scopes = $this->validateScopes(
  27.         $this->getQueryStringParameter('scope', $request, $this->defaultScope),
  28.         is_array($client->getRedirectUri())
  29.             ? $client->getRedirectUri()[0]
  30.             : $client->getRedirectUri()
  31.     );
  33.     // Finalize the requested scopes
  34.     $finalizedScopes = $this->scopeRepository->finalizeScopes(
  35.         $scopes,
  36.         $this->getIdentifier(),
  37.         $client
  38.     );
  40.     $stateParameter = $this->getQueryStringParameter('state', $request);
  42.     $authorizationRequest = new AuthorizationRequest();
  43.     $authorizationRequest->setGrantTypeId($this->getIdentifier());
  44.     $authorizationRequest->setClient($client);
  45.     $authorizationRequest->setRedirectUri($redirectUri);
  46.     $authorizationRequest->setState($stateParameter);
  47.     $authorizationRequest->setScopes($finalizedScopes);
  49.     return $authorizationRequest;
  50. }

接着，当用户同意授权之后，就要直接返回 access_token，League OAuth2 直接将令牌放入 JWT 中发送回第三方客户端,值得注意的是依据 OAuth2 标准，参数都是以 location hash 的形式返回的，间隔符是 #，而不是 ?:

  1. public function __construct(\DateInterval $accessTokenTTL, $queryDelimiter = '#')
  2. {
  3.     $this->accessTokenTTL = $accessTokenTTL;
  4.     $this->queryDelimiter = $queryDelimiter;
  5. }
  7. public function completeAuthorizationRequest(AuthorizationRequest $authorizationRequest)
  8. {
  9.     if ($authorizationRequest->getUser() instanceof UserEntityInterface === false) {
  10.         throw new \LogicException('An instance of UserEntityInterface should be set on the AuthorizationRequest');
  11.     }
  13.     $finalRedirectUri = ($authorizationRequest->getRedirectUri() === null)
  14.         ? is_array($authorizationRequest->getClient()->getRedirectUri())
  15.             ? $authorizationRequest->getClient()->getRedirectUri()[0]
  16.             : $authorizationRequest->getClient()->getRedirectUri()
  17.         : $authorizationRequest->getRedirectUri();
  19.     // The user approved the client, redirect them back with an access token
  20.     if ($authorizationRequest->isAuthorizationApproved() === true) {
  21.         $accessToken = $this->issueAccessToken(
  22.             $this->accessTokenTTL,
  23.             $authorizationRequest->getClient(),
  24.             $authorizationRequest->getUser()->getIdentifier(),
  25.             $authorizationRequest->getScopes()
  26.         );
  28.         $response = new RedirectResponse();
  29.         $response->setRedirectUri(
  30.             $this->makeRedirectUri(
  31.                 $finalRedirectUri,
  32.                 [
  33.                     'access_token' => (string) $accessToken->convertToJWT($this->privateKey),
  34.                     'token_type'   => 'Bearer',
  35.                     'expires_in'   => $accessToken->getExpiryDateTime()->getTimestamp() - (new \DateTime())->getTimestamp(),
  36.                     'state'        => $authorizationRequest->getState(),
  37.                 ],
  38.                 $this->queryDelimiter
  39.             )
  40.         );
  42.         return $response;
  43.     }
  45.     // The user denied the client, redirect them back with an error
  46.     throw OAuthServerException::accessDenied(
  47.         'The user denied the request',
  48.         $this->makeRedirectUri(
  49.             $finalRedirectUri,
  50.             [
  51.                 'state' => $authorizationRequest->getState(),
  52.             ]
  53.         )
  54.     );
  55. }

这个用于构建 jwt 的私钥就是 oauth-private.key，我们知道，jwt 一般有三个部分组成：header、claim、sign, 用于 oauth2 的 jwt 中 claim 主要构成有：

  • aud 客户端 id
  • jti access_token 随机码
  • iat 生成时间
  • nbf 拒绝接受 jwt 时间
  • exp access_token 失效时间
  • sub 用户 id

具体可以参考 : JSON Web Token (JWT) draft-ietf-oauth-json-web-token-32

  1. public function convertToJWT(CryptKey $privateKey)
  2. {
  3.     return (new Builder())
  4.         ->setAudience($this->getClient()->getIdentifier())
  5.         ->setId($this->getIdentifier(), true)
  6.         ->setIssuedAt(time())
  7.         ->setNotBefore(time())
  8.         ->setExpiration($this->getExpiryDateTime()->getTimestamp())
  9.         ->setSubject($this->getUserIdentifier())
  10.         ->set('scopes', $this->getScopes())
  11.         ->sign(new Sha256(), new Key($privateKey->getKeyPath(), $privateKey->getPassPhrase()))
  12.         ->getToken();
  13. }
  15. public function __construct(
  16.     Encoder $encoder = null,
  17.     ClaimFactory $claimFactory = null
  18. ) {
  19.     $this->encoder = $encoder ?: new Encoder();
  20.     $this->claimFactory = $claimFactory ?: new ClaimFactory();
  21.     $this->headers = ['typ'=> 'JWT', 'alg' => 'none'];
  22.     $this->claims = [];
  23. }
  25. public function setAudience($audience, $replicateAsHeader = false)
  26. {
  27.     return $this->setRegisteredClaim('aud', (string) $audience, $replicateAsHeader);
  28. }
  30. public function setId($id, $replicateAsHeader = false)
  31. {
  32.     return $this->setRegisteredClaim('jti', (string) $id, $replicateAsHeader);
  33. }
  35. public function setIssuedAt($issuedAt, $replicateAsHeader = false)
  36. {
  37.     return $this->setRegisteredClaim('iat', (int) $issuedAt, $replicateAsHeader);
  38. }
  40. public function setNotBefore($notBefore, $replicateAsHeader = false)
  41. {
  42.     return $this->setRegisteredClaim('nbf', (int) $notBefore, $replicateAsHeader);
  43. }
  45. public function setExpiration($expiration, $replicateAsHeader = false)
  46. {
  47.     return $this->setRegisteredClaim('exp', (int) $expiration, $replicateAsHeader);
  48. }
  50. public function setSubject($subject, $replicateAsHeader = false)
  51. {
  52.     return $this->setRegisteredClaim('sub', (string) $subject, $replicateAsHeader);
  53. }
  55. public function sign(Signer $signer, $key)
  56. {
  57.     $signer->modifyHeader($this->headers);
  59.     $this->signature = $signer->sign(
  60.         $this->getToken()->getPayload(),
  61.         $key
  62.     );
  64.     return $this;
  65. }
  67. public function getToken()
  68. {
  69.     $payload = [
  70.         $this->encoder->base64UrlEncode($this->encoder->jsonEncode($this->headers)),
  71.         $this->encoder->base64UrlEncode($this->encoder->jsonEncode($this->claims))
  72.     ];
  74.     if ($this->signature !== null) {
  75.         $payload[] = $this->encoder->base64UrlEncode($this->signature);
  76.     }
  78.     return new Token($this->headers, $this->claims, $this->signature, $payload);
  79. }

根据 JWT 的生成方法，签名部分 signature 是 header 与 claim 进行 base64 编码后再加密的结果。

客户端模式

客户端凭据授权适用于机器到机器的认证。例如，你可以在通过 API 执行维护任务中使用此授权。要使用这种授权，你首先需要在 app/Http/Kernel.php 的 routeMiddleware 变量中添加新的中间件：

  1. protected $routeMiddleware = [
  2.     'client' => CheckClientCredentials::class,
  3. ];
  5. Route::get('/user', function(Request $request) {
  6.     ...
  7. })->middleware('client');

接下来通过向 oauth/token 接口发出请求来获取令牌:

  1. $response = $guzzle->post('http://your-app.com/oauth/token', [
  2.     'form_params' => [
  3.         'grant_type' => 'client_credentials',
  4.         'client_id' => 'client-id',
  5.         'client_secret' => 'client-secret',
  6.         'scope' => 'your-scope',
  7.     ],
  8. ]);
  10. echo json_decode((string) $response->getBody(), true);

客户端模式类似于授权码模式的后一部分，利用客户端 id 与客户端密码来获取 access_token：

  1. public function respondToAccessTokenRequest(
  2.     ServerRequestInterface $request,
  3.     ResponseTypeInterface $responseType,
  4.     \DateInterval $accessTokenTTL
  5. ) {
  6.     // Validate request
  7.     $client = $this->validateClient($request);
  8.     $scopes = $this->validateScopes($this->getRequestParameter('scope', $request, $this->defaultScope));
  10.     // Finalize the requested scopes
  11.     $finalizedScopes = $this->scopeRepository->finalizeScopes($scopes, $this->getIdentifier(), $client);
  13.     // Issue and persist access token
  14.     $accessToken = $this->issueAccessToken($accessTokenTTL, $client, null, $finalizedScopes);
  16.     // Inject access token into response type
  17.     $responseType->setAccessToken($accessToken);
  19.     return $responseType;
  20. }

类似于授权码模式，access_token 的发放也是通过 Bearer Token 中存放 JWT。

密码模式

OAuth2 密码授权机制可以让你自己的客户端（如移动应用程序）邮箱地址或者用户名和密码获取访问令牌。如此一来你就可以安全地向自己的客户端发出访问令牌，而不需要遍历整个 OAuth2 授权代码重定向流程。

创建密码授权的客户端后，就可以通过向用户的电子邮件地址和密码向 /oauth/token 路由发出 POST 请求来获取访问令牌。而该路由已经由 Passport::routes 方法注册，因此不需要手动定义它。如果请求成功，会在服务端返回的 JSON 响应中收到一个 access_token 和 refresh_token：

  1. $response = $http->post('http://your-app.com/oauth/token', [
  2.     'form_params' => [
  3.         'grant_type' => 'password',
  4.         'client_id' => 'client-id',
  5.         'client_secret' => 'client-secret',
  6.         'username' => 'taylor@laravel.com',
  7.         'password' => 'my-password',
  8.         'scope' => '',
  9.     ],
  10. ]);
  12. return json_decode((string) $response->getBody(), true);

只要用用户名与密码来验证合法性就可以发放 access_token 与 refresh_token：

  1. public function respondToAccessTokenRequest(
  2.     ServerRequestInterface $request,
  3.     ResponseTypeInterface $responseType,
  4.     \DateInterval $accessTokenTTL
  5. ) {
  6.     // Validate request
  7.     $client = $this->validateClient($request);
  8.     $scopes = $this->validateScopes($this->getRequestParameter('scope', $request, $this->defaultScope));
  9.     $user = $this->validateUser($request, $client);
  11.     // Finalize the requested scopes
  12.     $finalizedScopes = $this->scopeRepository->finalizeScopes($scopes, $this->getIdentifier(), $client, $user->getIdentifier());
  14.     // Issue and persist new tokens
  15.     $accessToken = $this->issueAccessToken($accessTokenTTL, $client, $user->getIdentifier(), $finalizedScopes);
  16.     $refreshToken = $this->issueRefreshToken($accessToken);
  18.     // Inject tokens into response
  19.     $responseType->setAccessToken($accessToken);
  20.     $responseType->setRefreshToken($refreshToken);
  22.     return $responseType;
  23. }
  26. protected function validateUser(ServerRequestInterface $request, ClientEntityInterface $client)
  27. {
  28.     $username = $this->getRequestParameter('username', $request);
  29.     if (is_null($username)) {
  30.         throw OAuthServerException::invalidRequest('username');
  31.     }
  33.     $password = $this->getRequestParameter('password', $request);
  34.     if (is_null($password)) {
  35.         throw OAuthServerException::invalidRequest('password');
  36.     }
  38.     $user = $this->userRepository->getUserEntityByUserCredentials(
  39.         $username,
  40.         $password,
  41.         $this->getIdentifier(),
  42.         $client
  43.     );
  44.     if ($user instanceof UserEntityInterface === false) {
  45.         $this->getEmitter()->emit(new RequestEvent(RequestEvent::USER_AUTHENTICATION_FAILED, $request));
  47.         throw OAuthServerException::invalidCredentials();
  48.     }
  50.     return $user;
  51. }

路由保护

Passport 包含一个 验证保护机制 可以验证请求中传入的访问令牌。配置 api 的看守器使用 passport 驱动程序后，只需要在需要有效访问令牌的任何路由上指定 auth:api 中间件：

  1. Route::get('/user', function () {
  2.     //
  3. })->middleware('auth:api');

当调用 Passport 保护下的路由时，接入的 API 应用需要将访问令牌作为 Bearer 令牌放在请求头 Authorization 中。例如，使用 Guzzle HTTP 库时：

  1. $response = $client->request('GET', '/api/user', [
  2.     'headers' => [
  3.         'Accept' => 'application/json',
  4.         'Authorization' => 'Bearer '.$accessToken,
  5.     ],
  6. ]);

auth:api 中间件

当我们已经配置完成 Passport 的四种模式并拿到 access_token 之后，我们就可以利用令牌去资源服务器获取数据了。资源服务器最常用的校验令牌的中间件就是 auth:api，中间件是 auth，api 是中间件的参数：

  1. 'auth' => \Illuminate\Auth\Middleware\Authenticate::class,

这个中间件是验证登录状态的常用中间件：

  1. class Authenticate
  2. {
  3.     public function __construct(Auth $auth)
  4.     {
  5.         $this->auth = $auth;
  6.     }
  8.     public function handle($request, Closure $next, ...$guards)
  9.     {
  10.         $this->authenticate($guards);
  12.         return $next($request);
  13.     }
  16.     protected function authenticate(array $guards)
  17.     {
  18.         if (empty($guards)) {
  19.             return $this->auth->authenticate();
  20.         }
  22.         foreach ($guards as $guard) {
  23.             if ($this->auth->guard($guard)->check()) {
  24.                 return $this->auth->shouldUse($guard);
  25.             }
  26.         }
  28.         throw new AuthenticationException('Unauthenticated.', $guards);
  29.     }
  30. }

我们的参数 api 就是上面的 guards，Auth 是 laravel 自带的登录校验服务：

  1. class AuthManager implements FactoryContract
  2. {
  3.     public function guard($name = null)
  4.     {
  5.         $name = $name ?: $this->getDefaultDriver();
  7.         return $this->guards[$name] ?? $this->guards[$name] = $this->resolve($name);
  8.     }
  10.     protected function resolve($name)
  11.     {
  12.         $config = $this->getConfig($name);
  14.         if (is_null($config)) {
  15.             throw new InvalidArgumentException("Auth guard [{$name}] is not defined.");
  16.         }
  18.         if (isset($this->customCreators[$config['driver']])) {
  19.             return $this->callCustomCreator($name, $config);
  20.         }
  22.         $driverMethod = 'create'.ucfirst($config['driver']).'Driver';
  24.         if (method_exists($this, $driverMethod)) {
  25.             return $this->{$driverMethod}($name, $config);
  26.         }
  28.         throw new InvalidArgumentException("Auth guard driver [{$name}] is not defined.");
  29.     }
  31. }

文档告诉我们，若想要使用 passport 服务，我们的 config/auth 文件需要如此配置：

  1. 'guards' => [
  2.     'web' => [
  3.         'driver' => 'session',
  4.         'provider' => 'users',
  5.     ],
  7.     'api' => [
  8.         'driver' => 'passport',
  9.         'provider' => 'users',
  10.     ],
  11. ],

可以看出，driver 就是 passport，我们在启动 passport 服务的时候曾经注册过一个 Guard：

  1. protected function registerGuard()
  2. {
  3.     Auth::extend('passport', function ($app, $name, array $config) {
  4.         return tap($this->makeGuard($config), function ($guard) {
  5.             $this->app->refresh('request', $guard, 'setRequest');
  6.         });
  7.     });
  8. }
  10. protected function makeGuard(array $config)
  11. {
  12.     return new RequestGuard(function ($request) use ($config) {
  13.         return (new TokenGuard(
  14.             $this->app->make(ResourceServer::class),
  15.             Auth::createUserProvider($config['provider']),
  16.             $this->app->make(TokenRepository::class),
  17.             $this->app->make(ClientRepository::class),
  18.             $this->app->make('encrypter')
  19.         ))->user($request);
  20.     }, $this->app['request']);
  21. }

因此，passport 使用的就是这个 TokenGuard：

  1. class TokenGuard
  2. {
  3.     public function __construct(ResourceServer $server,
  4.                                 UserProvider $provider,
  5.                                 TokenRepository $tokens,
  6.                                 ClientRepository $clients,
  7.                                 Encrypter $encrypter)
  8.     {
  9.         $this->server = $server;
  10.         $this->tokens = $tokens;
  11.         $this->clients = $clients;
  12.         $this->provider = $provider;
  13.         $this->encrypter = $encrypter;
  14.     }
  16.     public function user(Request $request)
  17.     {
  18.         if ($request->bearerToken()) {
  19.             return $this->authenticateViaBearerToken($request);
  20.         } elseif ($request->cookie(Passport::cookie())) {
  21.             return $this->authenticateViaCookie($request);
  22.         }
  23.     }
  24. }

可以看到，TokenGuard 支持两种 Token 的验证：BearerToken 与 cookie。

我们首先看 BearerToken:

  1. public function bearerToken()
  2. {
  3.     $header = $this->header('Authorization', '');
  5.     if (Str::startsWith($header, 'Bearer ')) {
  6.         return Str::substr($header, 7);
  7.     }
  8. }
  10. protected function authenticateViaBearerToken($request)
  11. {
  12.     $psr = (new DiactorosFactory)->createRequest($request);
  14.     try {
  15.         $psr = $this->server->validateAuthenticatedRequest($psr);
  17.         $user = $this->provider->retrieveById(
  18.             $psr->getAttribute('oauth_user_id')
  19.         );
  21.         if (! $user) {
  22.             return;
  23.         }
  25.         $token = $this->tokens->find(
  26.             $psr->getAttribute('oauth_access_token_id')
  27.         );
  29.         $clientId = $psr->getAttribute('oauth_client_id');
  31.         if ($this->clients->revoked($clientId)) {
  32.             return;
  33.         }
  35.         return $token ? $user->withAccessToken($token) : null;
  36.     } catch (OAuthServerException $e) {
  37.         return Container::getInstance()->make(
  38.             ExceptionHandler::class
  39.         )->report($e);
  40.     }
  41. }

首先，需要验证请求的合法性：

  1. class ResourceServer
  2. {
  3.     public function validateAuthenticatedRequest(ServerRequestInterface $request)
  4.     {
  5.         return $this->getAuthorizationValidator()->validateAuthorization($request);
  6.     }
  8.     protected function getAuthorizationValidator()
  9.     {
  10.         if ($this->authorizationValidator instanceof AuthorizationValidatorInterface === false) {
  11.             $this->authorizationValidator = new BearerTokenValidator($this->accessTokenRepository);
  12.         }
  14.         $this->authorizationValidator->setPublicKey($this->publicKey);
  16.         return $this->authorizationValidator;
  17.     }
  19. }

BearerTokenValidator 专门用于验证 BearerToken 的合法性：

  1. class BearerTokenValidator implements AuthorizationValidatorInterface
  2. {
  3.     public function validateAuthorization(ServerRequestInterface $request)
  4.     {
  5.         if ($request->hasHeader('authorization') === false) {
  6.             throw OAuthServerException::accessDenied('Missing "Authorization" header');
  7.         }
  9.         $header = $request->getHeader('authorization');
  10.         $jwt = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header[0]));
  12.         try {
  13.             // Attempt to parse and validate the JWT
  14.             $token = (new Parser())->parse($jwt);
  15.             if ($token->verify(new Sha256(), $this->publicKey->getKeyPath()) === false) {
  16.                 throw OAuthServerException::accessDenied('Access token could not be verified');
  17.             }
  19.             // Ensure access token hasn't expired
  20.             $data = new ValidationData();
  21.             $data->setCurrentTime(time());
  23.             if ($token->validate($data) === false) {
  24.                 throw OAuthServerException::accessDenied('Access token is invalid');
  25.             }
  27.             // Check if token has been revoked
  28.             if ($this->accessTokenRepository->isAccessTokenRevoked($token->getClaim('jti'))) {
  29.                 throw OAuthServerException::accessDenied('Access token has been revoked');
  30.             }
  32.             // Return the request with additional attributes
  33.             return $request
  34.                 ->withAttribute('oauth_access_token_id', $token->getClaim('jti'))
  35.                 ->withAttribute('oauth_client_id', $token->getClaim('aud'))
  36.                 ->withAttribute('oauth_user_id', $token->getClaim('sub'))
  37.                 ->withAttribute('oauth_scopes', $token->getClaim('scopes'));
  38.         } catch (\InvalidArgumentException $exception) {
  39.             // JWT couldn't be parsed so return the request as is
  40.             throw OAuthServerException::accessDenied($exception->getMessage());
  41.         } catch (\RuntimeException $exception) {
  42.             //JWR couldn't be parsed so return the request as is
  43.             throw OAuthServerException::accessDenied('Error while decoding to JSON');
  44.         }
  45.     }
  46. }

通过 passport 拿到的 access_token 都是 JWT 格式的，因此首先第一步需要将 JWT 解析：

  1. class Parser
  2. {
  3.     public function parse($jwt)
  4.     {
  5.         $data = $this->splitJwt($jwt);
  6.         $header = $this->parseHeader($data[0]);
  7.         $claims = $this->parseClaims($data[1]);
  8.         $signature = $this->parseSignature($header, $data[2]);
  10.         foreach ($claims as $name => $value) {
  11.             if (isset($header[$name])) {
  12.                 $header[$name] = $value;
  13.             }
  14.         }
  16.         if ($signature === null) {
  17.             unset($data[2]);
  18.         }
  20.         return new Token($header, $claims, $signature, $data);
  21.     }
  23.     protected function splitJwt($jwt)
  24.     {
  25.         if (!is_string($jwt)) {
  26.             throw new InvalidArgumentException('The JWT string must have two dots');
  27.         }
  29.         $data = explode('.', $jwt);
  31.         if (count($data) != 3) {
  32.             throw new InvalidArgumentException('The JWT string must have two dots');
  33.         }
  35.         return $data;
  36.     }
  38.     protected function parseHeader($data)
  39.     {
  40.         $header = (array) $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));
  42.         if (isset($header['enc'])) {
  43.             throw new InvalidArgumentException('Encryption is not supported yet');
  44.         }
  46.         return $header;
  47.     }
  49.     protected function parseClaims($data)
  50.     {
  51.         $claims = (array) $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));
  53.         foreach ($claims as $name => &$value) {
  54.             $value = $this->claimFactory->create($name, $value);
  55.         }
  57.         return $claims;
  58.     }
  60.     protected function parseSignature(array $header, $data)
  61.     {
  62.         if ($data == '' || !isset($header['alg']) || $header['alg'] == 'none') {
  63.             return null;
  64.         }
  66.         $hash = $this->decoder->base64UrlDecode($data);
  68.         return new Signature($hash);
  69.     }
  71. }

获得 JWT 的三个部分之后，就要验证签名部分是否合法：

  1. class Token
  2. {
  3.     public function verify(Signer $signer, $key)
  4.     {
  5.         if ($this->signature === null) {
  6.             throw new BadMethodCallException('This token is not signed');
  7.         }
  9.         if ($this->headers['alg'] !== $signer->getAlgorithmId()) {
  10.             return false;
  11.         }
  13.         return $this->signature->verify($signer, $this->getPayload(), $key);
  14.     }
  15. }

验证通过之后，就要验证 JWT 各个部分是否合法：

  1. $data = new ValidationData();
  2. $data->setCurrentTime(time());
  4. public function __construct($currentTime = null)
  5. {
  6.     $currentTime = $currentTime ?: time();
  8.     $this->items = [
  9.         'jti' => null,
  10.         'iss' => null,
  11.         'aud' => null,
  12.         'sub' => null,
  13.         'iat' => $currentTime,
  14.         'nbf' => $currentTime,
  15.         'exp' => $currentTime
  16.     ];
  17. }
  20. public function validate(ValidationData $data)
  21. {
  22.     foreach ($this->getValidatableClaims() as $claim) {
  23.         if (!$claim->validate($data)) {
  24.             return false;
  25.         }
  26.     }
  28.     return true;
  29. }    
  31. public function __construct(array $callbacks = [])
  32. {
  33.     $this->callbacks = array_merge(
  34.         [
  35.             'iat' => [$this, 'createLesserOrEqualsTo'],
  36.             'nbf' => [$this, 'createLesserOrEqualsTo'],
  37.             'exp' => [$this, 'createGreaterOrEqualsTo'],
  38.             'iss' => [$this, 'createEqualsTo'],
  39.             'aud' => [$this, 'createEqualsTo'],
  40.             'sub' => [$this, 'createEqualsTo'],
  41.             'jti' => [$this, 'createEqualsTo']
  42.         ],
  43.         $callbacks
  44.     );
  45. }

我们前面说过，

  • aud 客户端 id
  • jti access_token 随机码
  • iat 生成时间
  • nbf 拒绝接受 jwt 时间
  • exp access_token 失效时间
  • sub 用户 id

因此，JWT 的生成时间、拒绝接受时间、失效时间就会被验证完成。

接下来，还会验证最重要的 access_token ：

  1. if ($this->accessTokenRepository->isAccessTokenRevoked($token->getClaim('jti'))) {
  2.     throw OAuthServerException::accessDenied('Access token has been revoked');
  3. }
  5. public function isAccessTokenRevoked($tokenId)
  6. {
  7.     return $this->tokenRepository->isAccessTokenRevoked($tokenId);
  8. }
  10. public function isAccessTokenRevoked($id)
  11. {
  12.     if ($token = $this->find($id)) {
  13.         return $token->revoked;
  14.     }
  16.     return true;
  17. }

接下来，TokenGuard 就会验证 userid、clientid 与 access_token 的合法性：

  1. $user = $this->provider->retrieveById(
  2.     $psr->getAttribute('oauth_user_id')
  3. );
  5. if (! $user) {
  6.     return;
  7. }
  9. $token = $this->tokens->find(
  10.     $psr->getAttribute('oauth_access_token_id')
  11. );
  13. $clientId = $psr->getAttribute('oauth_client_id');
  15. if ($this->clients->revoked($clientId)) {
  16.     return;
  17. }
  19. return $token ? $user->withAccessToken($token) : null;

中间件验证完成。

客户端模式中间件 CheckClientCredentials

我们在上面可以看到 auth:api 中间件不仅验证 access_token，还会验证 user_id，对于客户端模式来说，由于 JWT 中并没有用户信息，因此 passport 专门存在中间件 CheckClientCredentials 来做非登录状态的校验。

  1. class CheckClientCredentials
  2. {
  3.     public function handle($request, Closure $next, ...$scopes)
  4.     {
  5.         $psr = (new DiactorosFactory)->createRequest($request);
  7.         try {
  8.             $psr = $this->server->validateAuthenticatedRequest($psr);
  9.         } catch (OAuthServerException $e) {
  10.             throw new AuthenticationException;
  11.         }
  13.         $this->validateScopes($psr, $scopes);
  15.         return $next($request);
  16.     }
  17. }

使用 JavaScript 接入 API

在构建 API 时，如果能通过 JavaScript 应用接入自己的 API 将会给开发过程带来极大的便利。这种 API 开发方法允许你使用自己的应用程序的 API 和别人共享的 API。你的 Web 应用程序、移动应用程序、第三方应用程序以及可能在各种软件包管理器上发布的任何 SDK 都可能会使用相同的API。

通常，如果要从 JavaScript 应用程序中使用 API，则需要手动向应用程序发送访问令牌，并将其传递给应用程序。但是，Passport 有一个可以处理这个问题的中间件。将 CreateFreshApiToken 中间件添加到 web 中间件组就可以了：

  1. 'web' => [
  2.     // Other middleware...
  3.     \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
  4. ],

Passport 的这个中间件将会在你所有的对外请求中添加一个 laravel_token cookie。该 cookie 将包含一个加密后的 JWT ，Passport 将用来验证来自 JavaScript 应用程序的 API 请求。至此，你可以在不明确传递访问令牌的情况下向应用程序的 API 发出请求

  1. axios.get('/user')
  2.     .then(response => {
  3.         console.log(response.data);
  4.     });

当使用上面的授权方法时，Axios 会自动带上 X-CSRF-TOKEN 请求头传递。另外，默认的 Laravel JavaScript 脚手架会让 Axios 发送 X-Requested-With 请求头:

  1. window.axios.defaults.headers.common = {
  2.     'X-Requested-With': 'XMLHttpRequest',
  3. };

CreateFreshApiToken 中间件

  1. class CreateFreshApiToken
  2. {
  3.     public function handle($request, Closure $next, $guard = null)
  4.     {
  5.         $this->guard = $guard;
  7.         $response = $next($request);
  9.         if ($this->shouldReceiveFreshToken($request, $response)) {
  10.             $response->withCookie($this->cookieFactory->make(
  11.                 $request->user($this->guard)->getKey(), $request->session()->token()
  12.             ));
  13.         }
  15.         return $response;
  16.     }
  18.     public function make($userId, $csrfToken)
  19.     {
  20.         $config = $this->config->get('session');
  22.         $expiration = Carbon::now()->addMinutes($config['lifetime']);
  24.         return new Cookie(
  25.             Passport::cookie(),
  26.             $this->createToken($userId, $csrfToken, $expiration),
  27.             $expiration,
  28.             $config['path'],
  29.             $config['domain'],
  30.             $config['secure'],
  31.             true
  32.         );
  33.     }
  35.     protected function createToken($userId, $csrfToken, Carbon $expiration)
  36.     {
  37.         return JWT::encode([
  38.             'sub' => $userId,
  39.             'csrf' => $csrfToken,
  40.             'expiry' => $expiration->getTimestamp(),
  41.         ], $this->encrypter->getKey());
  42.     }
  44.     protected function shouldReceiveFreshToken($request, $response)
  45.     {
  46.         return $this->requestShouldReceiveFreshToken($request) &&
  47.                $this->responseShouldReceiveFreshToken($response);
  48.     }
  50.     protected function requestShouldReceiveFreshToken($request)
  51.     {
  52.         return $request->isMethod('GET') && $request->user($this->guard);
  53.     }
  55.     protected function responseShouldReceiveFreshToken($response)
  56.     {
  57.         return $response instanceof Response && ! $this->alreadyContainsToken($response);
  58.     }
  59. }

这个中间件发出的 JWT 令牌仍然由 auth:api 来负责验证，我们前面说过，TokenGuard 负责两种令牌的验证，一种是 BearerToken, 另一种就是这个 Cookie :

  1. public function user(Request $request)
  2. {
  3.     if ($request->bearerToken()) {
  4.         return $this->authenticateViaBearerToken($request);
  5.     } elseif ($request->cookie(Passport::cookie())) {
  6.         return $this->authenticateViaCookie($request);
  7.     }
  8. }
  10. protected function authenticateViaCookie($request)
  11. {
  12.     try {
  13.         $token = $this->decodeJwtTokenCookie($request);
  14.     } catch (Exception $e) {
  15.         return;
  16.     }
  18.     if (! $this->validCsrf($token, $request) ||
  19.         time() >= $token['expiry']) {
  20.         return;
  21.     }
  23.     if ($user = $this->provider->retrieveById($token['sub'])) {
  24.         return $user->withAccessToken(new TransientToken);
  25.     }
  26. }
  28. protected function decodeJwtTokenCookie($request)
  29. {
  30.     return (array) JWT::decode(
  31.         $this->encrypter->decrypt($request->cookie(Passport::cookie())),
  32.         $this->encrypter->getKey(), ['HS256']
  33.     );
  34. }
  36. protected function validCsrf($token, $request)
  37. {
  38.     return isset($token['csrf']) && hash_equals(
  39.         $token['csrf'], (string) $request->header('X-CSRF-TOKEN')
  40.     );
  41. }