問題描述

我的應(yīng)用很簡單，它連接到 Google+ API 對用戶進(jìn)行身份驗證，如果成功，它會檢索用戶的電子郵件，然后根據(jù)電子郵件對給定的數(shù)據(jù)庫執(zhí)行一系列操作取回.

My app is simple, it connects to the Google+ API to authenticate the user, and if successful, it retrieves the user's email and then performs a series of operations on a given database based on the email retrieved.

我的主要問題是，我的訪問令牌每小時都會過期，而我似乎不知道如何刷新"它.我收到以下錯誤，我認(rèn)為這是預(yù)期的:

My main issue is that every hour, my access token expires, and I seem not to know how to "refresh" it. I get the following error, which I imagine is expected:

The OAuth 2.0 access token has expired, and a refresh token is not available.

我目前正在將訪問令牌存儲在數(shù)據(jù)庫中，因此我可以根據(jù)需要進(jìn)行檢索.我唯一的問題是如何使用該令牌來獲得新令牌?

I am currently storing the access token on a database, and I can therefore retrieve if needed. My only question is how do I use that token to gain a new one?

推薦答案

哇，我花了很長時間才弄明白這個問題，而且這些答案對我來說似乎很不完整.

Whoa, it took me significantly longer to figure this out, and the answers out there seemed quite incomplete to me.

在我們開始之前請記住，這個答案假設(shè)您使用的是最新的 Google APIPHP 庫，截至 2014 年 5 月 26 日.

Before we start please keep in mind that this answer assumes you are using the latest Google API PHP Library, as of May 26th of 2014.

1 - 確保您的應(yīng)用請求的訪問類型是offline.refresh_token 否則不提供.來自 Google:此字段僅在授權(quán)代碼請求中包含 access_type=offline 時才存在.

1 - Make sure the access type your app requests is offline. A refresh_token is not provided otherwise. From Google: This field is only present if access_type=offline is included in the authorization code request.

$gClient->setAccessType('offline');

2 - 在第一次授權(quán)時，保留提供的 refresh_token 以供進(jìn)一步訪問.這可以通過cookies、數(shù)據(jù)庫等來完成.我選擇存儲在數(shù)據(jù)庫中:

2 - Upon the first authorization, persist the provided refresh_token for further access. This can be done via cookies, database, etc. I chose to store in on a database:

$tokens = json_decode($gClient->getAccessToken()); /* Get a JSON object */
setRefreshToken($con, $tokens->refresh_token /* Retrieve form JSON object */);

3 - 檢查 AccessToken 是否已過期，如果是這種情況，請從 Google 請求刷新的令牌.

3 - Check if the AccessToken has expired, and request a refreshed token from Google if such is the case.

if ($gClient->isAccessTokenExpired()) {    
  $refreshToken = getRefreshToken($con, $email); 
  $gClient->refreshToken($refreshToken);
}  

其中 getRefreshToken 是從我們的數(shù)據(jù)庫中檢索先前存儲的 refresh_token，然后我們將該值傳遞給客戶端的 refreshToken 方法.

Where getRefreshToken is retrieving the previously stored refresh_token from our database, and then we pass that value to the Client's refreshToken method.

快速說明:重要的是要記住，如果您之前已授權(quán)您的應(yīng)用程序，您可能不會在響應(yīng)中看到 refresh_token，因為它僅提供我們第一次調(diào)用authenticate.因此，您可以轉(zhuǎn)到 https://www.google.com/settings/security 和撤消對您的應(yīng)用的訪問權(quán)限，或者您可以在創(chuàng)建客戶端對象時添加以下行:

Quick Note: It's key to remember that if you had previously authorized your app, you probably won't see a refresh_token on the response, since it is only provided the first time we call authenticate. Therefore, you can either go to https://www.google.com/settings/security and Revoke Access to your app or you can add the following line when creating the Client object:

$gClient->setApprovalPrompt('force');

來自 Google:如果值為 force，則用戶會看到一個同意頁面，即使他們之前就給定的一組范圍同意了您的應(yīng)用程序.這反過來又確保了 refresh_token 在每次授權(quán)中提供.

From Google: If the value is force, then the user sees a consent page even if they previously gave consent to your application for a given set of scopes. Which in turn ensures that a refresh_token is provided on each authorization.

完整示例:http://pastebin.com/jA9sBNTk

這篇關(guān)于使用 OAuth Refresh Token 獲取新的 Access Token - Google API的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網(wǎng)！