Authenticating to Google Auth with PHP cURL causes continuously forwarding - php

Question

I want to retrieve the Auth token from Google OAuth 2.0 ( i used this tutorial)
However, when I want to Authenticate, it results in an infinite loop of redirecting to nothing, thus kind of refreshing the page. Without any error messages. I cannot find out whats going wrong.
This is my PHP code:
<?php
// Admin Google API settings
// Portal url:
require_once('./curl.php');
define("CALLBACK_URL", "http://localhost/losapi/index2.php"); //Callback URL
define("AUTH_URL", "https://accounts.google.com/o/oauth2/v2/auth"); //Used to get CODE (not Token!)
define("CLIENT_ID", "***"); // Personal
define("CLIENT_SECRET", "***"); // Personal
define("SCOPE", "https://www.googleapis.com/auth/admin.directory.device.chromeos https://www.googleapis.com/auth/admin.directory.user https://www.googleapis.com/auth/admin.directory.orgunit"); // Depends on what you want to do.
define("APIURL_DIRECTORY","https://www.googleapis.com/admin/directory/v1/customer/"); // For Google Directory actions
define("CUSTOMER_ID","***"); // Personal
define("TOKEN_URL","https://oauth2.googleapis.com/token"); // URL to get Token (not code).
$curl = new \CURL\cURL();
// Initiate code for access token
if(isset($_GET["code"])){
//DEBUG: echo "Code: ".$_GET["code"];
$url = TOKEN_URL."?";
$url .= "code=".$_GET["code"];
$url .= "&grant_type=authorization_code";
$url .= "&client_id=". urlencode(CLIENT_ID);
$url .= "&client_secret=". urlencode(CLIENT_SECRET);
$url .= "&redirect_uri=". urlencode(CALLBACK_URL);
$response = json_decode($curl->exeCurl($url,"POST"), true);
if(isset($response)){
if(array_key_exists("access_token", $response)) {
$access_token = $response;
setcookie("LOStoken", $response['access_token'], time() + (86400 * 30), "/"); // 86400 = 1 day
}
}
} else {
if(isset($_POST['gettoken'])){
$url = AUTH_URL."?";
$url .= "response_type=code";
$url .= "&client_id=". urlencode(CLIENT_ID);
$url .= "&scope=". urlencode(SCOPE);
$url .= "&redirect_uri=". urlencode(CALLBACK_URL);
echo $curl->exeCurl($url,"GET");
}
}
?>
curl.php
namespace CURL;
class cURL
{
// Algeneme cURL functie om web call te doen.
function exeCurl($url,$method,$body="") {
$curl = curl_init(); // initiate curl
// Afhankelijk van TOKEN worden er andere headers gegeven.
if(isset($_COOKIE["LOStoken"])){
$headers = array(
"Accept: */*",
"Accept-Encoding: gzip, deflate",
"Authorization: Bearer ". $_COOKIE["LOStoken"],
"Connection: keep-alive",
"Content-Length: ". strlen($body),
"Content-Type: application/json",
"cache-control: no-cache"
);
} else {
$headers = array(
"Accept: */*",
"Cache-Control: no-cache",
"Content-Length: ". strlen($body),
"Connection: keep-alive",
"cache-control: no-cache"
);
}
// Set parameters for curl
$params = array(
CURLOPT_URL => $url, // API URL
CURLOPT_RETURNTRANSFER => true, // Return answer
CURLOPT_SSL_VERIFYPEER => false, // SSL, enable in production
//CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10, // Max redirect
CURLOPT_FOLLOWLOCATION => true, // If 301, follow redirect
CURLOPT_TIMEOUT => 30, // Max timeout
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, // HTTP version used
CURLOPT_CUSTOMREQUEST => $method, // HTTP method used
CURLOPT_HTTPHEADER => $headers); // HTTP headers
// Combineer curl + parameters
curl_setopt_array($curl, $params);
// Curl antwoorden
$response = curl_exec($curl);
$err = curl_error($curl); // vul met errors
curl_close($curl); // Sluit verbinding
if ($err) {
echo "cURL Error #:" . $err; // Als er errors zijn
}
if(array_key_exists("error", $response)) echo $response["error_description"];
return $response; // Geef volledige antwoord terug
}
}

Answer 1

You are trying to fetch the auth URL via cURL - that can not work, this authorization flow requires user interaction. You need to redirect the user to this URL in their browser.
You can either redirect the user to that URL automatically; or you just put it into the href attribute of a link, so that the user can click on that then, to start the whole process. (I would recommend the second option in general, but at least during development. With an automatic redirect, there’s a good chance you’ll create a circular redirect again, if anything goes wrong.)