验证令牌ID并使用PHP访问令牌

Question

How can I use the OPENID with PHP, without using libs?

I was using the Twitch OAuth2.0 and after building the authentication I get the "id_token" and an "access_token".

How do I validate the id_token and the access_token using PHP to get a code?

Answer 1

ID Token is a kind of JWT . JWT is a kind of either JWS or JWE . The following are relevant specifications.

• OpenID Connect Core 1.0, 2. ID Token
• RFC 7519 : JSON Web Token (JWT)
• RFC 7515 : JSON Web Signature (JWS)
• RFC 7516 : JSON Web Encryption (JWE)

If you want to validate ID tokens without using libraries, as the first step, you have to understand the specifications. Then, do all the stuff like decoding, decrypting and verifying signatures using PHP standard functions.

NOTE: Regardless of whether ID Token is encrypted or not, a signature is attached. To verify the signature, if the algorithm of the signature is asymmetric, you have to get the public key which corresponds to the private key used for the signature.

On the other hand, the format of access tokens varies depending on implementations.