23andMe API 认证通过 PHP

Question

我正在关注 23andMe API authentication guidelines 并使用此代码将我的用户发送到 23andMe 进行身份验证和授权：

<?php

function base64url_encode($data)
{
 $b64 = base64_encode($data);
 if ($b64 === false) {
   return false;
 }
 $url = strtr($b64, '+/', '-_');
 return rtrim($url, '=');
}

$client_id    = 'xxx';
$redirect_uri = 'https://customURL';

// this is needed for custom redirect scheme
$code_verifier = 'yyy';
$hash = hash('sha256', $code_verifier);
$code_challenge = base64url_encode(pack('H*', $hash));

header("Location: https://api.23andme.com/authorize/"
    . "?redirect_uri=$redirect_uri"
    . "&response_type=code"
    . "&client_id=$client_id"
    . "&scope=basic"
    . "&code_challenge=$code_challenge");
?>

使用 Chrome DevTools 可以看到，一旦访问上述页面，就会获取以下 3 个 URL，并且用户授权访问：

https://auth.23andme.com/authorize/?scope=openid&response_type=code&client_id=api&redirect_uri=https%3A%2F%2Fapi.23andme.com%2Foauth_callback%2F

https://api.23andme.com/oauth_callback/?code=30edd45deb5f42d4bb7bd8413866cfc5&state=

https://api.23andme.com/authorize/?response_type=code&client_id=xxx&redirect_uri=https://customURL&scope=basic&code_challenge=wAYGGEPHpGhaG1gZTmyJ8M1Ly7JlGuoUVWBBVJ4OxTU

所以我可以看到代码参数已经生成（在这种情况下，给定值30edd45deb5f42d4bb7bd8413866。这个值应该给下面的代码（如$_GET["code"]）但它会导致500错误：

<?php    

$code = htmlspecialchars($_GET["code"]);

$code_verifier = 'yyy';

$post_field_array = array(
 'client_id'     => 'xxx',
 'client_secret' => 'zzz',
 'grant_type'    => 'authorization_code',
 'code'          => $code,
 'redirect_uri'  => 'https://customURL',
 'scope'         => 'basic',
 'code_verifier' => $code_verifier);

// Encode the field values for HTTP.
$post_fields = '';
foreach ($post_field_array as $key => $value)
 $post_fields .= "$key=" . urlencode($value) . '&';
$post_fields = rtrim($post_fields, '&');

// Use cURL to get the JSON response from 23andMe.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.23andme.com/token/');
curl_setopt($ch, CURLOPT_VERBOSE, true);
curl_setopt($ch, CURLOPT_POST, count($post_field_array));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
$encoded_json = curl_exec($ch);

$response = json_decode($encoded_json, true);
$access_token = $response['access_token'];

//show 
print_r($encoded_json);
echo $access_token;

?>

现在 500 的响应是：

https://api.23andme.com/authorize_check?response_type=code&client_id=xxx&redirect_uri=https%3A%2F%2FcustomURL&scope=basic&select_profile=false

感谢任何有关故障排除的建议。

Answer 1

您在 URL 编码方面存在一些问题；该问题并未明确说明您的问题是什么，但我建议您进行这些更改。

在第一个代码块中，您没有进行 URL 编码。如果您的值之一包含与号或其他特殊字符，这可能是一个问题。使用http_build_query() 安全地构建查询字符串。另外hash()可以直接输出二进制，所以结果不需要pack()和you should always exit after a redirection。 PHP 永远不需要关闭 ?> 标记，除非有 HTML 跟随（不应该有。）

<?php

function base64url_encode($data)
{
    $b64 = base64_encode($data);
    if ($b64 === false) {
        return false;
    }
    $url = strtr($b64, '+/', '-_');
    return rtrim($url, '=');
}

$code_verifier = 'yyy';
$hash = hash('sha256', $code_verifier, true);

$query_string_vars = [
    "redirect_uri"   => "https://customURL",
    "response_type"  => "code",
    "client_id"      => "xxx",
    "scope"          => "basic",
    "code_challenge" => base64url_encode($hash),
];

$url = "https://api.23andme.com/authorize/?" . http_build_query($query_string_vars);
header("Location: $url");
exit();

在您的第二个代码块中，您正在使用 urlencode() 对值进行编码，但这不是必需的，因为 cURL 会自动将传递给 CURLOPT_POSTFIELDS 的值编码为数组，或者您可以再次使用 http_build_query() 来传递字符串.此外，出于某种原因，您在代码值上使用了htmlspecialchars()，这很可能会破坏它。

<?php

$code_verifier = 'yyy';

$post_field_array = [
    'client_id'     => 'xxx',
    'client_secret' => 'zzz',
    'grant_type'    => 'authorization_code',
    'code'          => $_GET["code"],
    'redirect_uri'  => 'https://customURL',
    'scope'         => 'basic',
    'code_verifier' => $code_verifier
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => 'https://api.23andme.com/token/',
    CURLOPT_VERBOSE        => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($post_field_array),
    CURLOPT_RETURNTRANSFER => true,
    
]);
$json = curl_exec($ch);

$response = json_decode($json, true);
$access_token = $response['access_token'];

//show 
print_r($json);
echo $access_token;