php - 未经授权的谷歌访问 token

Question

我正在开发用于从谷歌分析帐户获取额外数据的模块。要获取此数据，Google 需要 access_token。
这是我到目前为止所管理的

if (isset($_GET['code'])) {
    // try to get an access token
    $code = $_GET['code'];
    $url = 'https://accounts.google.com/o/oauth2/token';
    $params = array(
        "code" => $code,
        "client_id" => "559825975819-881lg83vs8feo70v5unqa8kfoijuvfnn.apps.googleusercontent.com",
        "client_secret" => "vj4UNNItAJocX4RkNaD_3DQ4",
        "redirect_uri" => 'http://' . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"],
        "access_type" => "offline",
        "grant_type" => "authorization_code"
    );

    $ch = curl_init();
    curl_setopt($ch, constant("CURLOPT_" . 'URL'), $url);
    curl_setopt($ch, constant("CURLOPT_" . 'POST'), true);
    curl_setopt($ch, constant("CURLOPT_" . 'POSTFIELDS'), $params);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $output = curl_exec($ch);
    $info = curl_getinfo($ch);
    curl_close($ch);
 $data = (json_decode($output, true));


 $access_token_var = $data['access_token'];

  echo $access_token_var;

} else {

    $url = "https://accounts.google.com/o/oauth2/auth";

    $params = array(
        "response_type" => "code",
        "client_id" => "559825975819-881lg83vs8feo70v5unqa8kfoijuvfnn.apps.googleusercontent.com",
        "redirect_uri" => 'http://' . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"],
        "scope" => "https://www.googleapis.com/auth/analytics",
        "access_type" => "offline",
        "approval_prompt" => "force"
    );

    $request_to = $url . '?' . http_build_query($params);

    header("Location: " . $request_to);
}

我得到了 access_token，它在需要的变量中回显。但是我想在后台获取分析附加数据(例如，当客户下订单并点击订单按钮时​​)，但每次我需要新的access_token时，我都需要用我的google帐户授权，因此，网站上的每个客户都需要为此，尽管我设置了“access_type”=>“offline”。怎么了？还是我的 API 应用程序有问题？

Answer 1

访问 token 会在短时间内过期。您需要在每次过期时刷新访问 token 。

https://developers.google.com/identity/protocols/OAuth2WebServer

Access tokens periodically expire. You can refresh an access token without prompting the user for permission (including when the user is not present) if you requested offline access to the scopes associated with the token.

您无需刷新即可自己访问 token 。您可以使用 Goggle php 库 https://github.com/googleapis/google-api-php-client所以它可以自动刷新 token 。这是一个取自谷歌网站的例子。

$client = new Google_Client();
$client->setAuthConfig('client_secrets.json');
$client->addScope(Google_Service_Drive::DRIVE_METADATA_READONLY);

if (isset($_SESSION['access_token']) && $_SESSION['access_token']) {
  $client->setAccessToken($_SESSION['access_token']);
  $drive = new Google_Service_Drive($client);
  $files = $drive->files->listFiles(array())->getItems();
  echo json_encode($files);
} else {
  $redirect_uri = 'http://' . $_SERVER['HTTP_HOST'] . '/oauth2callback.php';
  header('Location: ' . filter_var($redirect_uri, FILTER_SANITIZE_URL));
}

如果您不想或不能使用 Google Php 库，当您将授权代码换成访问 token 时，Google 的授权服务器会返回一个刷新 token 。然后，如果访问 token 过期(或在任何其他时间)，您可以使用刷新 token 来获取新的访问 token 。您可以使用与通过 curl 获取访问 token 相同的方式，但使用不同的参数。

POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-Type: application/x-www-form-urlencoded

client_id=<your_client_id>&
client_secret=<your_client_secret>&
refresh_token=<refresh_token>&
grant_type=refresh_token