WeChat public platform development-WeChat authorized login (OAuth2.0), Public oauth2.0

Public platform development-authorized login (OAuth2.0), Public oauth2.0

1. Introduction to OAuth2.0

  OAuth(Open authorization) is an open standard that allows users to allow third-party applications to access private resources (such as photos, videos, and contact lists) stored on a user's website ), you do not need to provide the user name and password to third-party applications.

Allow Users Provide a token, Instead of using usernames and passwords to access the data they store in a specific service provider. Each token authorizes a specific website (for example, a video editing website) at a specific time period (for example, within the next two hours) to access specific resources (for example, only videos in a photo album ). In this way, OAuth allows users to authorize third-party websites to access the information they store on another service provider, without having to share their access permission or all the content of their data. Here we mainly simulate the process of using OAuth2.0 for authorization in the public account to obtain basic user information. For detailed development documentation, see the official documentation.

Public platform developer documentation:

Http://mp.weixin.qq.com/wiki/14/89b871b5466b19b3efa4ada8e577d45e.html

2. Obtain the test public account and related configurations.

1) obtain the public test account

Access the connection above, select "Interface Test number application" to get to open the http://mp.weixin.qq.com/debug/cgi-bin/sandboxinfo directly? Action = showinfo & t = sandbox/index: scan the client to log on.

After logon, you can obtain information about a public account. There are two parameters: appId and appsecret, which uniquely identify a public number and use them as parameters to obtain user information.

2) follow the public account

Only when a user pays attention to this public account can he authorize a third party to log on and obtain user information through the link with the public account information. Therefore, we also need to use our follow number. The operation is as follows: we can see that there is a QR code on the page that just jumps after the login is successful, you can scan the QR code to check that the "user list" on the right has more information about the user. As shown in: 3) When configuring the callback function, we can use the webpage authorization mechanism when the client accesses a third-party webpage (that is, our own webpage, we need not only the previously obtained appid and appsecret, but also the domain name settings for callback after user authorization, that is, where the page will jump to after user authorization. The specific configuration is as follows:

On the previous page, there is a "webpage authorization to obtain basic user information" and click Modify next to it.

Enter the callback Domain Name: If your website is not blacklisted, it will appear on the top
Then, the domain name configuration is successful!

Note::

1. Enter the domain name (a string) instead of the URL. Therefore, do not add http: // and other protocol headers. 2. Configure the authorization callback domain name as a full domain name, for example, the need for web site authorization Domain Name: www.qq.com, after the configuration of this domain name under the page http://www.qq.com/music.html, http://www.qq.com/login.html can be OAuth2.0 authentication. But http://pay.qq.com, http://music.qq.com, http://qq.com cannot perform OAuth2.0 Authentication

Here, we can get the test information we must use, including

• Obtain the public account appID and appsecret;
• Follow the public number we tested;
• Configure the domain name for callback after the user authorization by scanning the code.

3. Authorize logon and obtain basic user information

Authorization uses OAuth2.0 authorization. Mainly include the followingSimple Steps:

Step 1: The user agrees to the authorization and obtains the code

Step 2: Exchange code for webpage authorization access_token

Step 3: refresh access_token (if needed)

Step 4: Pull user information (scope must be snsapi_userinfo)

 

  Detailed stepsAs follows:

1. the user follows the public account.

2. The Public Account provides the URL of the user request authorization page.

3. the user clicks the authorization page URL to initiate a request to the server

4. The server asks if the user agrees to authorize the Public Account (this step is not performed when scope is snsapi_base)

5. the user agrees (this step is not performed when scope is snsapi_base)

6. the server sends the CODE to the public account through callback.

7. Get CODE from the Public Account

8. The public account requests Access Token from the server through CODE

9. The server returns the Access Token and OpenID to the public account.

10. The public account requests user information from the server through Access Token (this step is not performed when scope is snsapi_base)

11. The server sends the user information back to the Public Account (this step is unavailable when scope is snsapi_base)

1) authorize the user and obtain the code

Create a new file named oauth under the root directory of the domain name (the previously configured callback domain name. php (the name is whatever you want, And the redirect_uri below can be modified accordingly) the php implementation function is also very simple, just retrieve the code parameter on the url and print it out, this makes it easy for us to perform the following operations.

The content in Oauth. php is as follows:

<?php
if (isset($_GET['code'])){
    echo $_GET['code'];
}else{
    echo "NO CODE";
}
?>

The main purpose of php is to transfer the user to the redirect_uri address after the user confirms the authorized login and carries the code parameter (generated). For convenience, this can also be a blank page. There are other methods below to get the code parameter above the url.

Authorization request page construction method:

https://open.weixin.qq.com/connect/oauth2/authorize?appid=APPID&redirect_uri=REDIRECT_URI&response_type=code&scope=SCOPE&state=STATE#wechat_redirect

Parameter description

Parameters	Required	Description
Appid	Yes	The unique ID of the Public Account (this is the one we previously applied)
Redirect_uri	Yes	The callback link address for redirection after authorization (previously applied)
Response_type	Yes	Return type. Enter the code
Scope	Yes	Application Authorization scope, snsapi_base (the authorization page is not displayed, Jump directly, only the user's openid can be obtained), snsapi_userinfo (the authorization page is displayed, and the nickname, gender, and location can be obtained through openid. In addition, users can obtain information even if they do not pay attention to it)
State	No	After redirection will carry the state parameter, developers can fill in the a-zA-Z0-9 parameter value, up to 128 bytes, the value will be returned as is, we can compare it to prevent attacks by others.
# Wechat_redirect	No	Open the link directly. You can leave this parameter empty. This parameter must be included in page 302 redirection

 

Application Authorization scope: Because snsapi_base can only obtain openid, it is of little significance, so we use snsapi_userinfo.
Callback address: Enter the address of the uploaded oauth. php file,
State parameter: Enter 123 as a number.

Note: Due to the high security level of authorization operations, the authorization link will undergo regular and strong matching when initiating an authorization request,If the Parameter order of the link is incorrect, the authorization page cannot be accessed normally.

Construct the request url as follows:

https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx4a22b50d7e897f97&redirect_uri=http%3a%2f%2fad.seewo.com%2foauth.php&response_type=code&scope=snsapi_userinfo&state=123#wechat_redirect

This must be sent to the browser before it can be opened.

Click the above link and click "Confirm Logon" to go To the configured callback page and obtain the Returned code parameters for the following operations.

The authorization page is as follows:

The page to jump to after authorization (redirect_uri we configured earlier ):

If no code is printed in php, you can click the copy link in the upper-right corner to obtain the link as follows:

http://ad.seewo.com/oauth2.php?code=0217a07e9c194dbf539c45c266b2dcfZ&state=123

Code Description:

Code is used as the ticket for access_token. The code for each user authorization is different. The code can only be used once and will automatically expire if it is not used for 5 minutes.

1) Use code in exchange for access_token

In exchange for the webpage authorization access_token page construction method:

Https://api.weixin.qq.com/sns/oauth2/access_token? Appid = APPID & secret = SECRET & code = CODE & grant_type = authorization_code

Parameter description

Parameters	Required?	Description
Appid	Yes	Unique public ID
Secret	Yes	Appsecret of Public Account
Code	Yes	Enter the code parameter obtained in step 1.
Grant_type	Yes	Enter authorization_code

Code: Enter the value obtained in the previous step.
The constructed url is as follows:

https://api.weixin.qq.com/sns/oauth2/access_token?appid=wx41cb8dbd827a16e9&secret=d4624c36b6795d1d99dcf0547af5443d&code=00137323023ab55775be09d6d8e75ffA&grant_type=authorization_code 

Only the link for obtaining code must be clicked on the client. You can directly open the access_token and user information on the webpage.

Return description

The returned JSON data packet is as follows:

{

   "access_token":"ACCESS_TOKEN",

   "expires_in":7200,

   "refresh_token":"REFRESH_TOKEN",

   "openid":"OPENID",

   "scope":"SCOPE"

}

 

Parameters	Description
Access_token	Webpage authorization interface call credential. Note: This access_token is different from the access_token supported by the Basic.
Expires_in	Access_token interface call credential timeout time, in seconds)
Refresh_token	User refresh access_token
Openid	Unique User ID
Scope	User-authorized scopes, separated by commas (,)

When an error occurs, the JSON data packet is returned as follows (the sample Code is invalid ):

{"errcode":40029,"errmsg":"invalid code"}

2) obtain user information through access_token and openid

Request Method:

https://api.weixin.qq.com/sns/userinfo?access_token=ACCESS_TOKEN&openid=OPENID

  Parameter description

Parameters	Description
Access_token	Webpage authorization interface call credential. Note: This access_token is different from the access_token supported by the Basic.
Openid	Unique User ID

The url is constructed as follows:

https://api.weixin.qq.com/sns/userinfo?access_token=OezXcEiiBSKSxW0eoylIeABONBTt9gBE6cK3arF_L6aOvwU4ynS5ZxG4r6ZUIJxh7y_ClmPRkYbMeOc_r30LAGB2IEAlCFsQQvfQMJSwHcU6109-6vz603Jho4oZhdns6AOXwoxaWcLujT1RWnC_hQ&openid=oF3PcsnsrMiJzEwalZZbAfWQpxCI

You can directly execute this in the browser.

The data in json format is as follows:

{

   "openid":" OPENID",

   " nickname": NICKNAME,

   "sex":"1",

   "province":"PROVINCE"

   "city":"CITY",

   "country":"COUNTRY",

    "headimgurl":    "http://wx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46", 

"privilege":[

"PRIVILEGE1"

"PRIVILEGE2"

    ],

    "unionid": "o6_bmasdasdsad6_2sgVt7hMZOPfL"

}

Parameters	Description
Openid	Unique User ID
Nickname	User nickname
Sex	Gender of the user. If the value is 1, the user is male. If the value is 2, the user is female. If the value is 0, the user is unknown.
Province	Province of the user's personal data
City	City for normal user Personal Data
Country	Country, such as CN
Headimgurl	User profile picture. The last value indicates the size of the square profile picture (optional values include 0, 46, 64, 96, and 132, and 0 indicates the size of the 640x640 square profile picture ), this item is blank when the user does not have an avatar. If you change the profile picture, the original profile picture URL becomes invalid.
Privilege	User Privilege information, which is a json array. For example, the Waka user is (chinaunicom)
Unionid	This field appears only when you bind a public account to an open platform account. For details, see obtain user personal information (UnionID mechanism)

If an error occurs, a JSON packet is returned as follows (the openid is invalid in this example ):

{"errcode":40003,"errmsg":" invalid openid "}

Note:

In the user management interface, the "interface for obtaining basic user information" is used to obtain basic user information based on the user's OpenID after a message interaction or event push occurs between the user and the public account. This interface, including other interfaces,All are requiredThis user (that is, openid) can be called successfully only after paying attention to the public account.

Webpage authorization also follows the UnionID mechanism to obtain basic user information. That is, if a developer needs to bind a public account to multiple public accounts, or to unify user accounts between public accounts and mobile applications, go to the open platform (open.weixin.qq.com) to bind the public account, the UnionID mechanism can be used to meet the above requirements.

  Description of UnionID Mechanism: If a developer has multiple mobile applications, website applications, and public accounts, you can obtain the unionid in the basic user information to differentiate the uniqueness of users, unionid is the same for different applications (mobile applications, website applications, and public accounts) on the same open platform.

Note: Because the secret of the Public Account and the obtained access_token have a very high security level, they must be saved only on the server and cannot be transmitted to the client. Subsequent steps such as refreshing access_token and getting user information through access_token must also be initiated from the server.

Thank you!