oauth1.a&2.0以get，head，post请求access_token[php]

忽如一夜春风来，千万开放平台开。然而开放平台不是开房平台，你需要先申请一个叫access_token的东东。这个东西就是你在开放平台上的应用(consumer)、开放平台、使用你的应用来访问自身数据客户的一个三方契约；契约写明本用户允许consumer访问本用户在开房平台上的数据；consumer每次拿着这个契约给开房平台看一下，就可以大摇大摆的取得想要的数据了。

取得access token常用的有两种方法：oauth1.a和oauth2.0（本来存在oauth1.0，后来因为安全性问题被弃用）。流程开始之前，你必须为你的应用申请一个consumer_key（任意申请key和token都会附带secret，secret在2.0里面基本没啥用），consumer_key用于申请，consumer_secret+当前其他token附带的secret用于提取传输参数的签名，校验正确性。

oauth1.a是一种比较繁琐的认证流程。它要先使用consumer_key申请一个未授权的request token，用户授权之后变为授权的request token并生成一个verified以get方式送到应用的回调地址（无回调地址即ood，会发送一个pin code到浏览器），然后应用将发送授权的request_token（事实上和未授权的一样，因此上步不存在新的secret）+verified申请access_token.
之后调用api时需要将access token+函数参数+(consumer_secret+access_secret)提取签名发送到开房平台，开放平台将函数结果返回。

oauth2一种存在4中方式申请，采用了https加密，因此不用个人手动提取签名，且认证步骤简化，所以说简单很多。另外，其返回结果通常是以json格式返回。在此就不一一解释了。

Http请求数据可以有多种方式，在开放平台中接受三种: post, get, head. post将数据放在http请求体中，get将请求数据放在网址中和网址以?分割，head不是head request是把请求放在head中，实验表明其方式是get. 具体实验写在后面。由于get是将所有数据以近乎于明文的方式拼接到网址，因此post，head相对安全点，所以在发送某些敏感数据时推荐使用post。

============================================烦人的理论到此为止=============================================================

在oauth1.a&2.0申请token过程中，需要发送多次http请求，有些需要请求需要浏览器重定向。所以先封装各种不同的用于发送的http请求的类，使用了一个工厂，方便调用不同的请求方式。

sender.php

<?php
abstract class Sender{
public abstract function send($url, $data);
}

abstract class GetSender extends Sender{
protected function makeUrl($aUrl, $data){
$url=$aUrl.'?';
foreach($data as $key=>$value){
if($url.chr(strlen($url)-1)!='?'){
$url.='&';
}
$url=$url.$key.'='.$value;
}
return $url;
}
}

abstract class PostSender extends Sender{
}

abstract class HeadSender extends Sender{
protected function makeHead($data){
$head = array();
if(array_key_exists('oauth_version', $data) && $data['oauth_version']=='1.0'){
$head[0] = 'Authorization: OAuth ';
}else{
$head[0] = 'Authorization: OAuth2 ';
}
foreach($data as $key=>$value){
$head[0] = $head[0].$key.'='.$value.',';
}
$head[0][strlen($head[0])-1]=null;
return $head;
}
}

class RedirectGetSender extends GetSender{
public function send($url, $data){
$url = $this->makeUrl($url, $data);
header("Location:$url");
}
}

class DirectGetSender extends GetSender{
public function send($url, $data){
$url = $this->makeUrl($url, $data);
$result = file_get_contents($url);
return $result;
}
}
class RedirectPostSender extends PostSender{
public function send($url, $data){
echo "click submit to authorize!<br>";
echo '<form action="'.$url.'" method="post">';
foreach($data as $key=>$value){
echo '<input type="hidden" name='.$key.' value="'.$value.'"/>';
}
echo '<input type="submit" value="SBUMIT">';
echo '</form>';
}
}
class DirectPostSender extends PostSender{
public function send($url, $data){
$curlHandle = curl_init();
curl_setopt($curlHandle, CURLOPT_URL, $url);
curl_setopt($curlHandle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curlHandle, CURLOPT_HTTPHEADER, array('Expect:'));
curl_setopt($curlHandle, CURLOPT_POST, true);
curl_setopt($curlHandle, CURLOPT_POSTFIELDS, http_build_query($data));
$result = curl_exec($curlHandle);
curl_close($curlHandle);
return $result;
}
}
class DirectHeadSender extends HeadSender{
public function send($url, $data){
$head = $this->makeHead($data);
$curlHandle = curl_init();
curl_setopt($curlHandle, CURLOPT_URL, $url);
curl_setopt($curlHandle, CURLOPT_HEADER, false);
curl_setopt($curlHandle, CURLOPT_HTTPHEADER, $head);
curl_setopt($curlHandle, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curlHandle, CURLOPT_FRESH_CONNECT, 1);
$result = curl_exec($curlHandle);
curl_close($curlHandle);
return $result;
}
}
class RedirectHeadsender extends HeadSender{
public function send($url, $data){
echo "There are no head method for this redirect request!<br>";
}
}
class SenderFactory{
public static function createSender($isRedirect, $mode){
switch (strtolower($mode)){
case "get":
if($isRedirect===true){
return new RedirectGetSender();
}else{
return new DirectGetSender();
}
break;
case "post":
if($isRedirect===true){
return new RedirectPostSender();
}else{
return new DirectPostSender();
}
break;
case "head":
if($isRedirect ===true){
return new RedirectHeadSender();
}else{
return new DirectHeadSender();
}
break;
}
}
}
?>

--------------------------------------oauth1.a----------------------------------------------------------

url->base string类；签名类：

url.php

<?php
class Helper_URL
{
/**
* * Build HTTP Query
* *
* * @param array $params Name => value array of
* parameters
* *
* * @return string HTTP query
* */
public static function buildHttpQuery(array $params)
{
if (empty($params)) {
return '';
}

$keys   = self::urlEncode(array_keys($params));
$values = self::urlEncode(array_values($params));
$params = array_combine($keys, $values);
uksort($params, 'strcmp');
$pairs = array();
foreach ($params as $key => $value) {
$pairs[] =  $key . '=' . $value;
}
return implode('&', $pairs);
}
/**
* * URL Encode
* *
* * @param mixed $item string or array of items
* to url encode;
* *
* * @return mixed url encoded string
* or array of strings
* */
public static function urlEncode($item)
{
static $search  = array('%7E');
static $replace = array('~');
if (is_array($item)) {
return array_map(array(__CLASS__, 'urlEncode'), $item);
}
if (is_scalar($item) === false) {
return $item;
}
return str_replace($search, $replace, rawurlencode($item));
}
/**
* * URL Decode
* *
* * @param mixed $item Item to url decode
* *
* * @return string URL decoded string
* */
public static function urlDecode($item)
{
if (is_array($item)) {
return array_map(array(__CLASS__, 'urlDecode'), $item);
}
return rawurldecode($item);
}
}
?>

signature.php

<?php
include_once('url.php');
/*
* This class is used to generate the signature of base string.
* $url is the url your request will be sended to. and if in 'get' mode it is
* only the part before '?';
* $reqMod is request mode: 'get', 'post'; when paremeters are put in the head,
* its request mode is 'get';
* $params are all the params except 'oauth_signature';
* $consumerSecret is your consumer_secret;
* $token_secret is the secret you got in the nearest formal step;
*/
class Signaturer{
public function getSignature($url, $reqMode, array $params, $consumerSecret, $tokenSecret=''){
$baseStr = $this->getBaseStr($reqMode, $url, $params);
if(isSet($params['oauth_signature_method'])){
$signMethod = $this->getSignMethod($params['oauth_signature_method']);
}else{
$signMethod = 'sha1';
}
$key = $this->getKey($consumerSecret, $tokenSecret);
return base64_encode(hash_hmac($signMethod, $baseStr, $key, true));
}

/* used for constructing the base string.
* */
public function getBaseStr($method, $url, $params){
if (array_key_exists('oauth_signature', $params)) {
unset($params['oauth_signature']);
}
$urlParts = explode('?', $url);
$parts = array(strtoupper($method), $urlParts[0], Helper_URL::buildHTTPQuery($params));
return implode('&', Helper_URL::urlEncode($parts));
}

/*
* used to analyse signature method automatically
* */
public function getSignMethod($signMethod){
list($begin, $end) = explode('-', $signMethod);
return strtolower($end);
}
/*
* create key for signature;
* in the first step, since there is no secret, it is "$consumerSecret&"
* */
public function getKey($consumerSecret, $tokenSecret = ''){
$secrets = array($consumerSecret, $tokenSecret);
return implode('&', Helper_URL::urlEncode($secrets));
}
}

?>

oauthTokenFetcher.php

<?php
include_once('sender.php');
include_once('signaturer.php');
/*
* to apply an access_token, there are three step:
* 1. consumer (get post head) a request for unauthorised_request_token and an
* unauthorizised request token would be sended back;
* 2. consumer redirect to the authorization center url;
* 3. consumer get the authorized request token in the callback url; and then
* consumer (get post head) a request for access token; finally, an access
* token is sended back;
*/

class OauthTokenFetcher{
private $signaturer;
function __construct(){
$this->signaturer = new Signaturer();
}
public function setNonceStamp(array &$params){
$params['oauth_nonce'] = md5(mt_rand());
$params['oauth_timestamp'] = time();
}
public function fetchToken($url, $reqMode, array $params, $consumerSecret, $tokenSecret, $tokenStyle='request_token'){
$reqParam = strtolower($reqMode)==='head'?'get':$reqMode;
$params['oauth_signature'] = $this->signaturer->getSignature($url, $reqParam, $params, $consumerSecret, $tokenSecret);
foreach($params as $key=>$value){
$params[$key] = Helper_URL::urlEncode($value);
}
if($tokenStyle === 'request_token'){
$sender = SenderFactory::createSender(true, $reqMode);
$sender->send($url, $params);
}else{
$sender = SenderFactory::createSender(false, $reqMode);
$result = $sender->send($url, $params);
return $result;
}
}
/*
* parse return of fetchToken
* */
public function parse($str){
$infoTmps = explode('&', $str);
$info = array();
foreach($infoTmps as $value){
list($begin, $end) = explode('=', $value);
$info[$begin] = $end;
}
return $info;
}
}
?>

--待续--