Guzzle and Form + Basic Auth issues with Laravel - php

Question

I have been looking into grabbing some data from Livecoding.tv, and i am currently reusing my Oauth2 controller that i used for the twitch API, which should be pretty straightforward.
If someone does not know, the flow used by Oauth is the following:
Redirect user to third party Oauth link with your app code.
User Authorizes.
User redirected to your website again, with an Authorized token, that you can then post to the third party to get your refresh token etc.
Now on step 3, i am running into some problems. Here is the description and example by the developer:
Getting token: https://www.livecoding.tv/o/token/
Header
A HTTP Basic auth, using the application_code as username, and application_secret as password, as seen in the example below.
POST Body
code=EXAMPLE Token gotten from redirect
grant_type=Your grant type (authorization_type)
redirect_uri=Your redirect URL
And here is an example cURL request from the documentation of a working curl request.
curl -X POST -d "grant_type=authorization_code&code=Php4iJpXGpDT8lCqgBcbfQ2yzhB0Av&client_id=vCk6rNsC&redirect_uri=http://localhost/externalapp" -u"vCk6rNsC:sfMxcHUuNnZ" https://www.livecoding.tv/o/token/
So i tried to make this in Postman(https://www.getpostman.com/), which worked out of the box, i then asked Postman to convert this to PHP, to see if i had missed something. Here is the outcome of the working Postman request:
<?php
$curl = curl_init();
curl_setopt_array($curl, array(
CURLOPT_URL => "https://www.livecoding.tv/o/token/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "code=SOMECODE&client_id=SOMECLIENTID&redirect_uri=SOMEURL&grant_type=authorization_code",
CURLOPT_HTTPHEADER => array(
"authorization: Basic U09NRVVTRVI6U09NRVBBU1NXT1JE",
"cache-control: no-cache",
"content-type: application/x-www-form-urlencoded",
"postman-token: c8df4bbc-cbd0-73eb-df35-80210989db33"
),
));
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
I was pretty happy this worked out right away, so i just needed to make a Guzzle client do the same, which already works for the Twitch Oauth, here is my code for that:
{
$providers = ServiceProvider::findOrFail(2);
$client = new Client([
'base_uri' => $providers->oauth_url . '/token/',
'form_params' => [
'code' => $token,
'grant_type' => 'authorization_code',
'client_id' => $providers->application_code,
'redirect_uri' => $providers->redirection_url
],
'auth' => [
'somestring',
'someotherstring',
],
'headers' => [
'Content type' => 'application/x-www-form-urlencoded',
'cache-control' => 'no-cache'
]
]);
$response = $client->request('POST');
return ($response);
}
This would just return me with a 401, so i decided to do some debugging, and here is the request that comes, if i stop it right before it is sent:
Client {#637 ▼
-config: array:10 [▼
"base_uri" => Uri {#676 ▼
-scheme: "https"
-userInfo: ""
-host: "www.livecoding.tv"
-port: null
-path: "/o/token/"
-query: ""
-fragment: ""
}
"form_params" => array:4 [▼
"code" => "SOMECODE"
"grant_type" => "authorization_code"
"client_id" => "SOMECLIENTID"
"redirect_uri" => "http://REDIRECTURI"
]
"auth" => array:2 [▼
0 => "SOMECLIENTID"
1 => "SOMECLIENTSECRET"
]
"headers" => array:3 [▼
"Content type" => "application/x-www-form-urlencoded"
"cache-control" => "no-cache"
"User-Agent" => "GuzzleHttp/6.2.1 curl/7.26.0 PHP/5.6.27-1~dotdeb+7.1"
]
"handler" => HandlerStack {#664 ▼
-handler: Closure {#671 ▼
class: "GuzzleHttp\Handler\Proxy"
parameters: {▼
$request: {▼
typeHint: "Psr\Http\Message\RequestInterface"
}
$options: {▼
typeHint: "array"
}
}
use: {▼
$default: Closure {#669 ▼
class: "GuzzleHttp\Handler\Proxy"
parameters: {▼
$request: {▼
typeHint: "Psr\Http\Message\RequestInterface"
}
$options: {▼
typeHint: "array"
}
}
use: {▼
$default: CurlMultiHandler {#634 ▼
-factory: CurlFactory {#667 ▼
-handles: []
-maxHandles: 50
}
-selectTimeout: 1
-active: null
-handles: []
-delays: []
}
$sync: CurlHandler {#666 ▼
-factory: CurlFactory {#665 ▼
-handles: []
-maxHandles: 3
}
}
}
file: "/LARAVELPATH/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php"
line: "25 to 29"
}
$streaming: StreamHandler {#670 ▼
-lastHeaders: []
}
}
file: "LARAVELPATH/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php"
line: "49 to 53"
}
-stack: array:4 [▼
0 => array:2 [▼
0 => Closure {#672 ▼
class: "GuzzleHttp\Middleware"
parameters: {▶}
file: "LARAVELPATH/vendor/guzzlehttp/guzzle/src/Middleware.php"
line: "54 to 69"
}
1 => "http_errors"
]
1 => array:2 [▼
0 => Closure {#673 ▼
class: "GuzzleHttp\Middleware"
parameters: {▶}
file: "LARAVELPATH/vendor/guzzlehttp/guzzle/src/Middleware.php"
line: "148 to 150"
}
1 => "allow_redirects"
]
2 => array:2 [▼
0 => Closure {#674 ▼
class: "GuzzleHttp\Middleware"
parameters: {▶}
file: "LARAVELPATH/vendor/guzzlehttp/guzzle/src/Middleware.php"
line: "27 to 43"
}
1 => "cookies"
]
3 => array:2 [▼
0 => Closure {#675 ▼
class: "GuzzleHttp\Middleware"
parameters: {▶}
file: "LARAVELPATH/vendor/guzzlehttp/guzzle/src/Middleware.php"
line: "216 to 218"
}
1 => "prepare_body"
]
]
-cached: null
}
"allow_redirects" => array:5 [▼
"max" => 5
"protocols" => array:2 [▼
0 => "http"
1 => "https"
]
"strict" => false
"referer" => false
"track_redirects" => false
]
"http_errors" => true
"decode_content" => true
"verify" => true
"cookies" => false
]
}
As you can see here, there is just a parameter called 'auth' in here, and not the basic auth that is documented in Guzzle here: http://docs.guzzlephp.org/en/latest/request-options.html#auth
Though i would mention that the correct values are entered.
For the debugging i just did dd($client), i do not know if this will give me all the answers?
So the other possibility is to base64 encode it (like it is done in basic auth in general), and add a "Authorization" header manually, i tried that, but i am unaware if i am doing it correctly when i do:
$credentials = base64_encode($clientvariable . ':' . $clientsecretvariable)
Would that be the correct way? Though i would rather use this as a last resort if i do not get the auth parameter to work in Guzzle.
I am aware of the other Stackoverflow questions about Guzzle and basic auth, and yes i have read them, hopefully i have provided with enough information to show that.

Answer 1

The problem here was related to how i return the response from Guzzle.
Since i just returned $response, which is just the stream, the browser never got anything returned, and since chrome auto refresh, he runs the request twice, and on the second time, i would have just my code twice, which would have returned an error.
I ended up going crazy about this, until i changed browser, and saw that nothing ever happened, which pointed me in the right direction.