Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

beznez's avatar

OAuth2 not seeing my request

Hi Laracasts, I've started making an API in Laravel 5. I implemented OAuth2 using bshaffer/oauth2-server-php. I followed the guide that the Github page links to: it's here. I was able to implement everything just fine.

Now when I get a token from the server using this command:

curl -u testclient:testpass "http://localhost:8000/oauth/token" -X POST -d "grant_type=password&username=bshaffer&password=brent123"

I get a proper response:

{"access_token":"ebc6f2cc174f5b6b2ce8e134bc4520ba905c2695","expires_in":3600,"token_type":"Bearer","scope":null,"refresh_token":"b15ef7b5053f3195db7855e499db3af0592154e5"}

However, when I try to send a request to a protected page:

curl -u testclient:testpass "http://localhost:8000/private" -X POST -d "access_token=ebc6f2cc174f5b6b2ce8e134bc4520ba905c2695"

It returns:

{"error":"Unauthorized"}

Now here's my route:

Route::post('private', function()
{
    $bridgedRequest  = OAuth2\HttpFoundationBridge\Request::createFromRequest(Request::instance());
    $bridgedResponse = new OAuth2\HttpFoundationBridge\Response();

    if (App::make('oauth2')->verifyResourceRequest($bridgedRequest, $bridgedResponse)) {
        
        $token = App::make('oauth2')->getAccessTokenData($bridgedRequest);
        
        return Response::json(array(
            'private' => 'stuff',
            'user_id' => $token['user_id'],
            'client'  => $token['client_id'],
            'expires' => $token['expires'],
        ));
    }
    else {
        return Response::json(array(
            'error' => 'Unauthorized'
        ), $bridgedResponse->getStatusCode());
    }
});

So verifyResourceRequest is returning false. I dug into the library and this method looks good:

public function verifyResourceRequest(RequestInterface $request, ResponseInterface $response = null, $scope = null)
    {
        $this->response = is_null($response) ? new Response() : $response;
        $value = $this->getResourceController()->verifyResourceRequest($request, $this->response, $scope);

        return $value;
    }

So I returned the request to see what is in it. I got this response from Request::all():

{"access_token":"ebc6f2cc174f5b6b2ce8e134bc4520ba905c2695"}

So the information IS there. But, $bridgedRequest = OAuth2\HttpFoundationBridge\Request::createFromRequest(Request::instance()); is not picking up on this becuase it's failing. The token is valid. The client credentials are valid. I also tried Request::createFromGlobals() instead of Request::instance() but that had no effect. What are my next steps to figure out the problem?

One other question if anyone knows a bunch about OAuth: How do I send the token to a GET route?

0 likes
0 replies

Please or to participate in this conversation.