/** * Creates a signed JWT. * @param array $payload * @return string The signed JWT. */ private function makeSignedJwt($payload) { $header = array('typ' => 'JWT', 'alg' => 'RS256'); $segments = array(Utils::urlSafeB64Encode(json_encode($header)), Utils::urlSafeB64Encode(json_encode($payload))); $signingInput = implode('.', $segments); $signer = new P12Signer($this->privateKey, $this->privateKeyPassword); $signature = $signer->sign($signingInput); $segments[] = Utils::urlSafeB64Encode($signature); return implode(".", $segments); }
function verifySignedJwtWithCerts($jwt, $certs, $required_audience) { $segments = explode(".", $jwt); if (count($segments) != 3) { throw new Exception("Wrong number of segments in token: {$jwt}"); } $signed = $segments[0] . "." . $segments[1]; $signature = Utils::urlSafeB64Decode($segments[2]); // Parse envelope. $envelope = json_decode(Utils::urlSafeB64Decode($segments[0]), true); if (!$envelope) { throw new Exception("Can't parse token envelope: " . $segments[0]); } // Parse token $json_body = Utils::urlSafeB64Decode($segments[1]); $payload = json_decode($json_body, true); if (!$payload) { throw new Exception("Can't parse token payload: " . $segments[1]); } // Check signature $verified = false; foreach ($certs as $keyName => $pem) { $public_key = new PemVerifier($pem); if ($public_key->verify($signed, $signature)) { $verified = true; break; } } if (!$verified) { throw new Exception("Invalid token signature: {$jwt}"); } // Check issued-at timestamp $iat = 0; if (array_key_exists("iat", $payload)) { $iat = $payload["iat"]; } if (!$iat) { throw new Exception("No issue time in token: {$json_body}"); } $earliest = $iat - self::CLOCK_SKEW_SECS; // Check expiration timestamp $now = time(); $exp = 0; if (array_key_exists("exp", $payload)) { $exp = $payload["exp"]; } if (!$exp) { throw new Exception("No expiration time in token: {$json_body}"); } if ($exp >= $now + self::MAX_TOKEN_LIFETIME_SECS) { throw new Exception("Expiration time too far in future: {$json_body}"); } $latest = $exp + self::CLOCK_SKEW_SECS; if ($now < $earliest) { throw new Exception("Token used too early, {$now} < {$earliest}: {$json_body}"); } if ($now > $latest) { throw new Exception("Token used too late, {$now} > {$latest}: {$json_body}"); } // TODO(beaton): check issuer field? // Check audience $aud = $payload["aud"]; if ($aud != $required_audience) { throw new Exception("Wrong recipient, {$aud} != {$required_audience}: {$json_body}"); } // All good. return new LoginTicket($envelope, $payload); }
/** * @param $name * @param $arguments * @return HttpRequest|array * @throws \GoogleApi\Exception */ public function __call($name, $arguments) { if (!isset($this->methods[$name])) { throw new \GoogleApi\Exception("Unknown function: {$this->serviceName}->{$this->resourceName}->{$name}()"); } $method = $this->methods[$name]; $parameters = $arguments[0]; // postBody is a special case since it's not defined in the discovery document as parameter, but we abuse the param entry for storing it $postBody = null; if (isset($parameters['postBody'])) { if (is_object($parameters['postBody'])) { $this->stripNull($parameters['postBody']); } // Some APIs require the postBody to be set under the data key. if (is_array($parameters['postBody']) && 'latitude' == $this->serviceName) { if (!isset($parameters['postBody']['data'])) { $rawBody = $parameters['postBody']; unset($parameters['postBody']); $parameters['postBody']['data'] = $rawBody; } } $postBody = is_array($parameters['postBody']) || is_object($parameters['postBody']) ? json_encode($parameters['postBody']) : $parameters['postBody']; unset($parameters['postBody']); if (isset($parameters['optParams'])) { $optParams = $parameters['optParams']; unset($parameters['optParams']); $parameters = array_merge($parameters, $optParams); } } if (!isset($method['parameters'])) { $method['parameters'] = array(); } $method['parameters'] = array_merge($method['parameters'], $this->stackParameters); foreach ($parameters as $key => $val) { if ($key != 'postBody' && !isset($method['parameters'][$key])) { throw new \GoogleApi\Exception("({$name}) unknown parameter: '{$key}'"); } } if (isset($method['parameters'])) { foreach ($method['parameters'] as $paramName => $paramSpec) { if (isset($paramSpec['required']) && $paramSpec['required'] && !isset($parameters[$paramName])) { throw new \GoogleApi\Exception("({$name}) missing required param: '{$paramName}'"); } if (isset($parameters[$paramName])) { $value = $parameters[$paramName]; $parameters[$paramName] = $paramSpec; $parameters[$paramName]['value'] = $value; unset($parameters[$paramName]['required']); } else { unset($parameters[$paramName]); } } } // Discovery v1.0 puts the canonical method id under the 'id' field. if (!isset($method['id'])) { $method['id'] = $method['rpcMethod']; } // Discovery v1.0 puts the canonical path under the 'path' field. if (!isset($method['path'])) { $method['path'] = $method['restPath']; } $restBasePath = $this->service->restBasePath; // Process Media Request $contentType = false; if (isset($method['mediaUpload'])) { $media = MediaFileUpload::process($postBody, $parameters); if ($media) { $contentType = isset($media['content-type']) ? $media['content-type'] : null; $postBody = isset($media['postBody']) ? $media['postBody'] : null; $restBasePath = $method['mediaUpload']['protocols']['simple']['path']; $method['path'] = ''; } } $url = REST::createRequestUri($restBasePath, $method['path'], $parameters); $httpRequest = new HttpRequest($url, $method['httpMethod'], null, $postBody); if ($postBody) { $contentTypeHeader = array(); if (isset($contentType) && $contentType) { $contentTypeHeader['content-type'] = $contentType; } else { $contentTypeHeader['content-type'] = 'application/json; charset=UTF-8'; $contentTypeHeader['content-length'] = Utils::getStrLen($postBody); } $httpRequest->setRequestHeaders($contentTypeHeader); } $httpRequest = Client::$auth->sign($httpRequest); if (Client::$useBatch) { return $httpRequest; } // Terminate immediatly if this is a resumable request. if (isset($parameters['uploadType']['value']) && 'resumable' == $parameters['uploadType']['value']) { return $httpRequest; } return REST::execute($httpRequest); }
private function getResumeUri(HttpRequest $httpRequest) { $result = null; $body = $httpRequest->getPostBody(); if ($body) { $httpRequest->setRequestHeaders(array('content-type' => 'application/json; charset=UTF-8', 'content-length' => Utils::getStrLen($body), 'x-upload-content-type' => $this->mimeType, 'expect' => '')); } $response = Client::$io->makeRequest($httpRequest); $location = $response->getResponseHeader('location'); $code = $response->getResponseHttpCode(); if (200 == $code && true == $location) { return $location; } throw new \GoogleApi\Exception("Failed to start the resumable upload"); }
/** * @param array $headers The HTTP request headers * to be set and normalized. */ public function setRequestHeaders($headers) { $headers = Utils::normalize($headers); if ($this->requestHeaders) { $headers = array_merge($this->requestHeaders, $headers); } $this->requestHeaders = $headers; }