PHP Google_Utils::urlSafeB64Decode方法代码示例

 /**
  * Most of the logic for ID token validation is in AuthTest - 
  * this is just a general check to ensure we verify a valid
  * id token if one exists.
  */
 public function testValidateIdToken()
 {
     if (!$this->checkToken()) {
         return;
     }
     $client = $this->getClient();
     $token = json_decode($client->getAccessToken());
     $segments = explode(".", $token->id_token);
     $this->assertEquals(3, count($segments));
     // Extract the client ID in this case as it wont be set on the test client.
     $data = json_decode(Google_Utils::urlSafeB64Decode($segments[1]));
     $oauth = new Google_Auth_OAuth2($client);
     $this->assertInstanceOf("Google_Auth_LoginTicket", $oauth->verifyIdToken($token->id_token, $data->aud));
     // TODO(ianbarber): Need to be smart about testing/disabling the
     // caching for this test to make sense. Not sure how to do that
     // at the moment.
     $client = $this->getClient();
     $client->setIo(new Google_IO_Stream($client));
     $data = json_decode(Google_Utils::urlSafeB64Decode($segments[1]));
     $oauth = new Google_Auth_OAuth2($client);
     $this->assertInstanceOf("Google_Auth_LoginTicket", $oauth->verifyIdToken($token->id_token, $data->aud));
 }

 function verifySignedJwtWithCerts($jwt, $certs, $required_audience)
 {
     $segments = explode(".", $jwt);
     if (count($segments) != 3) {
         throw new Google_AuthException("Wrong number of segments in token: {$jwt}");
     }
     $signed = $segments[0] . "." . $segments[1];
     $signature = Google_Utils::urlSafeB64Decode($segments[2]);
     // Parse envelope.
     $envelope = json_decode(Google_Utils::urlSafeB64Decode($segments[0]), true);
     if (!$envelope) {
         throw new Google_AuthException("Can't parse token envelope: " . $segments[0]);
     }
     // Parse token
     $json_body = Google_Utils::urlSafeB64Decode($segments[1]);
     $payload = json_decode($json_body, true);
     if (!$payload) {
         throw new Google_AuthException("Can't parse token payload: " . $segments[1]);
     }
     // Check signature
     $verified = false;
     foreach ($certs as $keyName => $pem) {
         $public_key = new googlePemVerifier($pem);
         if ($public_key->verify($signed, $signature)) {
             $verified = true;
             break;
         }
     }
     if (!$verified) {
         throw new Google_AuthException("Invalid token signature: {$jwt}");
     }
     // Check issued-at timestamp
     $iat = 0;
     if (array_key_exists("iat", $payload)) {
         $iat = $payload["iat"];
     }
     if (!$iat) {
         throw new Google_AuthException("No issue time in token: {$json_body}");
     }
     $earliest = $iat - self::CLOCK_SKEW_SECS;
     // Check expiration timestamp
     $now = time();
     $exp = 0;
     if (array_key_exists("exp", $payload)) {
         $exp = $payload["exp"];
     }
     if (!$exp) {
         throw new Google_AuthException("No expiration time in token: {$json_body}");
     }
     if ($exp >= $now + self::MAX_TOKEN_LIFETIME_SECS) {
         throw new Google_AuthException("Expiration time too far in future: {$json_body}");
     }
     $latest = $exp + self::CLOCK_SKEW_SECS;
     if ($now < $earliest) {
         throw new Google_AuthException("Token used too early, {$now} < {$earliest}: {$json_body}");
     }
     if ($now > $latest) {
         throw new Google_AuthException("Token used too late, {$now} > {$latest}: {$json_body}");
     }
     // TODO(beaton): check issuer field?
     // Check audience
     $aud = $payload["aud"];
     if ($aud != $required_audience) {
         throw new Google_AuthException("Wrong recipient, {$aud} != {$required_audience}: {$json_body}");
     }
     // All good.
     return new Google_LoginTicket($envelope, $payload);
 }

 /**
  * Verifies the id token, returns the verified token contents.
  *
  * @param $jwt string the token
  * @param $certs array of certificates
  * @param $required_audience string the expected consumer of the token
  * @param [$issuer] the expected issues, defaults to Google
  * @param [$max_expiry] the max lifetime of a token, defaults to MAX_TOKEN_LIFETIME_SECS
  * @throws Google_Auth_Exception
  * @return mixed token information if valid, false if not
  */
 public function verifySignedJwtWithCerts($jwt, $certs, $required_audience, $issuer = null, $max_expiry = null)
 {
     if (!$max_expiry) {
         // Set the maximum time we will accept a token for.
         $max_expiry = self::MAX_TOKEN_LIFETIME_SECS;
     }
     $segments = explode(".", $jwt);
     if (count($segments) != 3) {
         throw new Google_Auth_Exception("Wrong number of segments in token: {$jwt}");
     }
     $signed = $segments[0] . "." . $segments[1];
     $signature = Google_Utils::urlSafeB64Decode($segments[2]);
     // Parse envelope.
     $envelope = json_decode(Google_Utils::urlSafeB64Decode($segments[0]), true);
     if (!$envelope) {
         throw new Google_Auth_Exception("Can't parse token envelope: " . $segments[0]);
     }
     // Parse token
     $json_body = Google_Utils::urlSafeB64Decode($segments[1]);
     $payload = json_decode($json_body, true);
     if (!$payload) {
         throw new Google_Auth_Exception("Can't parse token payload: " . $segments[1]);
     }
     // Check signature
     $verified = false;
     foreach ($certs as $keyName => $pem) {
         $public_key = new Google_Verifier_Pem($pem);
         if ($public_key->verify($signed, $signature)) {
             $verified = true;
             break;
         }
     }
     if (!$verified) {
         throw new Google_Auth_Exception("Invalid token signature: {$jwt}");
     }
     // Check issued-at timestamp
     $iat = 0;
     if (array_key_exists("iat", $payload)) {
         $iat = $payload["iat"];
     }
     if (!$iat) {
         throw new Google_Auth_Exception("No issue time in token: {$json_body}");
     }
     $earliest = $iat - self::CLOCK_SKEW_SECS;
     // Check expiration timestamp
     $now = time();
     $exp = 0;
     if (array_key_exists("exp", $payload)) {
         $exp = $payload["exp"];
     }
     if (!$exp) {
         throw new Google_Auth_Exception("No expiration time in token: {$json_body}");
     }
     if ($exp >= $now + $max_expiry) {
         throw new Google_Auth_Exception(sprintf("Expiration time too far in future: %s", $json_body));
     }
     $latest = $exp + self::CLOCK_SKEW_SECS;
     if ($now < $earliest) {
         throw new Google_Auth_Exception(sprintf("Token used too early, %s < %s: %s", $now, $earliest, $json_body));
     }
     if ($now > $latest) {
         throw new Google_Auth_Exception(sprintf("Token used too late, %s > %s: %s", $now, $latest, $json_body));
     }
     $iss = $payload['iss'];
     if ($issuer && $iss != $issuer) {
         throw new Google_Auth_Exception(sprintf("Invalid issuer, %s != %s: %s", $iss, $issuer, $json_body));
     }
     // Check audience
     $aud = $payload["aud"];
     if ($aud != $required_audience) {
         throw new Google_Auth_Exception(sprintf("Wrong recipient, %s != %s:", $aud, $required_audience, $json_body));
     }
     // All good.
     return new Google_Auth_LoginTicket($envelope, $payload);
 }