使用刷新令牌獲取訪問令牌

Question

我目前正在實施OAuth2，使用thephpleague/oauth2庫。我已經添加了刷新令牌授權，並且訪問令牌響應已包含刷新令牌。但是，我不知道如何使用該刷新令牌來獲取新的訪問令牌。

我檢查了文檔，但我沒有看到任何關於它的信息。 oauth2-client庫有它的方法，但我不打算使用它。

我對刷新代金券授予代碼：

$server->setRefreshTokenStorage(new RefreshTokenStorage); 

$refreshTokenGrant = new \League\OAuth2\Server\Grant\RefreshTokenGrant(); 
$authCodeGrant = new \League\OAuth2\Server\Grant\AuthCodeGrant(); 

$server->addGrantType($authCodeGrant); 
$server->addGrantType($refreshTokenGrant); 
$response = $server->issueAccessToken(); 

我的問題是如何測試，使用刷新令牌，我可以獲取新的訪問令牌？我是否必須實施與授權碼授權使用的端點不同的新端點？

這是我獲取令牌的代碼。任何意見？

public function actionToken(){ 

    $authCodeModel = new \app\models\OAuth_Auth_Codes; 

    if(!isset($_POST['code'])){ 
     throw new \yii\web\HttpException(400,"Required parameter \'code\' is missing or invalid."); 
    } 

    $result = $authCodeModel->find()->where(['authorization_code' => trim($_POST['code'])])->one(); 

    if(!empty($result)){ 

     $user_id = $result->user_id; 

     $session2 = new Session(); 
     $session2->open(); 

     $server = new AuthorizationServer; 
     $server->setSessionStorage(new SessionStorage); 
     $server->setAccessTokenStorage(new AccessTokenStorage); 
     $server->setClientStorage(new ClientStorage); 
     $server->setScopeStorage(new ScopeStorage); 
     $server->setAuthCodeStorage(new AuthCodeStorage); 
     $server->setRefreshTokenStorage(new RefreshTokenStorage); 

     $refreshTokenGrant = new \League\OAuth2\Server\Grant\RefreshTokenGrant(); 
     $authCodeGrant = new \League\OAuth2\Server\Grant\AuthCodeGrant(); 

     $server->addGrantType($authCodeGrant); 
     $server->addGrantType($refreshTokenGrant); 

     $response = $server->issueAccessToken(); 

     $model = new \app\models\OAuth_Access_Tokens(); 
     $accessTokenModel = $model->find()->where(['access_token' => $response['access_token']])->one(); 
     $accessTokenModel->setAttribute('user_id',''.$user_id); 
     $accessTokenModel->save(FALSE); 

     return json_encode($response); 
    } 
    else{ 
     throw new \yii\web\UnauthorizedHttpException("You have provided an invalid authorization code."); 
    } 
} 

Answer 1

使用PHP捲曲的支持將是：

$postData = array(
    "grant_type" => "refresh_token", 
    "client_id" => $clientID, 
    "client_secret" => $clientSecret, 
    "refresh_token" => $refreshToken 
); 
$ch = curl_init(); 
curl_setopt($ch, CURLOPT_URL, $tokenEndpoint); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postData)); 
$response = curl_exec($ch); 
curl_close($ch); 
$r = json_decode($response); 
echo $r->access_token; 

編輯： 對於服務器端的例子看：https://github.com/thephpleague/oauth2-server/blob/master/tests/unit/Grant/RefreshTokenGrantTest.php，例如：

$server = new AuthorizationServer(); 
$grant = new RefreshTokenGrant(); 
$server->addGrantType($grant); 
$server->issueAccessToken();