1

我从 facebook 示例http://developers.facebook.com/docs/authentication/server-side/使用它来验证我页面上的用户

<?php 

$app_id = "YOUR_APP_ID";
$app_secret = "YOUR_APP_SECRET";
$my_url = "YOUR_URL";

session_start();
$code = $_REQUEST["code"];

if(empty($code)) {
 $_SESSION['state'] = md5(uniqid(rand(), TRUE)); //CSRF protection
 $dialog_url = "http://www.facebook.com/dialog/oauth?client_id=" 
 . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
 . $_SESSION['state'];

echo("<script> top.location.href='" . $dialog_url . "'</script>");
}

if($_REQUEST['state'] == $_SESSION['state']) {
 $token_url = "https://graph.facebook.com/oauth/access_token?"
 . "client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url)
 . "&client_secret=" . $app_secret . "&code=" . $code;

$response = file_get_contents($token_url);
$params = null;
parse_str($response, $params);

$graph_url = "https://graph.facebook.com/me?access_token=" 
. $params['access_token'];

$user = json_decode(file_get_contents($graph_url));
echo("Hello " . $user->name);
}
else {
 echo("The state does not match. You may be a victim of CSRF.");
}

?>

我可以从

$dialog_url = "http://www.facebook.com/dialog/oauth?client_id=" 
 . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
 . $_SESSION['state'];

卷曲？或者我可以通过 top.location 等其他方式获取状态参数吗？

4

0 回答 0