PHP oauth服务器的登录过程

Question

I'm implementing the oauth php server as described here:

http://code.google.com/p/oauth-php/wiki/ServerHowTo

My problem is with the authorize.php controller. If the user is not logged in to the oauth provider, as required for them to auhorize the request token, I need to take them through my login process, however when I return to the authorization page it has lost the request token that was originally being submitted for authorization.

Does anybody have an idea of the best workflow for this? Do i simply pass all the query parameters received thought the whole process? Are there any security concerns or other gotchas with doing this manually. Is there perhaps an existing demo that shows how this is done.

Cheers

Answer 1

If the user is not logged in to the oauth provider, as required for them to auhorize the request token, I need to take them through my login process, however when I return to the authorization page it has lost the request token that was originally being submitted for authorization.

Stick it (and any other data you need that might get lost) in their session before you redirect them through your login mechanism, then fetch it once the login has completed and the authorization needs to happen. This eliminates the need to pass it through every form element, at the tiny risk of the user dumping his cookies along the way.