A Beginner’s Guide to OAuth and OpenID Connect (Longhorn PHP 2026) - Speaker Deck

Share

Embed

Start on current slide

Slide 1

Slide 1 text

Ben Ramsey • Longhorn PHP • October 16, 2026 OAuth & OpenID Connect A Beginner’s Guide Alexander Grigorian / Pexels

Slide 2

Slide 2 text

Who here has signed in with… Apple? Google? GitHub? Elissa Garcia / Unsplash

Slide 3

Slide 3 text

You’re trying out a new dev tool. You click “Sign in with GitHub.” You land on GitHub, not the app.

Slide 4

Slide 4 text

GitHub shows you what the app wants access to. You click Authorize. You’re back in the app & logged in.

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

Before OAuth… App A: We have some cool stu we can do with your data in App B. May we have access, pretty please? You: Sure. I trust you. Here’s my username and password to App B. Wow! This mash-up is so cool! I gotta tell all my friends! ff Alena Darmel / Pexels

Slide 7

Slide 7 text

…you gave them your password. Full access Not just the data they asked for, but everything No expiry Access lasts until you change your password No revocation Can’t take it back without changing your password No audit trail No way to know what they did iMattSmart / Unsplash

Slide 8

Slide 8 text

The Twitter problem Early Twitter (2007–2010) Every third-party app asked for your Twitter username and password TweetDeck, Twitterri c, Seesmic This was just…how it worked fi Sanket Mishra / Pexels

Slide 9

Slide 9 text

What if, instead of your password… …you issued a limited-use token? • Scoped • Time-restricted • Revocable

Slide 10

Slide 10 text

OAuth is about delegated authorization, granting a third party limited access to your resources, without sharing your password.

Slide 11

Slide 11 text

Resource Owner The User owns the data • grants access uses Client consents requests / issues token Authorization Server The App Auth Server / Idp wants access to the resource issues tokens after consent calls with token Resource Server The API holds the data • validates tokens

Slide 12

Slide 12 text

Resource Owner You uses Client consents requests / issues token The dev tool Authorization Server github.com calls with token Resource Server api.github.com

Slide 13

Slide 13 text

One Organization Two Organizations Authorization Server Authorization Server github.com Okta • Auth0 • Keycloak token token Resource Server Resource Server api.github.com Your API

Slide 14

Slide 14 text

Authorization code flow The most common, most secure OAuth ow. Why this one rst? • Used by virtually every web and mobile app • The access token never passes through the browser • Once you understand this, every other ow is just a variation fi fl fl BOOM Photography / Pexels

Slide 15

Slide 15 text

1 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request

Slide 16

Slide 16 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 17

Slide 17 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 18

Slide 18 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 19

Slide 19 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 20

Slide 20 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 21

Slide 21 text

1. Client redirect https: github.com/login/oauth/authorize ?response_type=code &client_id=abc123 &redirect_uri=https: example.com/callback &scope=read:user%20repo / / / / &state=xK9mQ2

Slide 22

Slide 22 text

1 2 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request User authentication and consent

Slide 23

Slide 23 text

2. User authentication & consent

Slide 24

Slide 24 text

1 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request User authentication and consent 2 Authorization code redirect 3

Slide 25

Slide 25 text

3. Authorization code redirect https: example.com/callback ?code=TEMP_CODE_HERE / / &state=xK9mQ2

Slide 26

Slide 26 text

3. Authorization code redirect https: example.com/callback ?code=TEMP_CODE_HERE / / &state=xK9mQ2

Slide 27

Slide 27 text

3. Authorization code redirect https: example.com/callback ?code=TEMP_CODE_HERE / / &state=xK9mQ2

Slide 28

Slide 28 text

1 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request User authentication and consent 2 Authorization code redirect 3 4 Code exchange (server-side)

Slide 29

Slide 29 text

4. Code exchange (server-side) POST /login/oauth/access_token HTTP/1.1 host: github.com content-type: application/x-www-form-urlencoded grant_type=authorization_code &code=TEMP_CODE_HERE &redirect_uri=https: example.com/callback &client_id=abc123 / / &client_secret=super_secret

Slide 30

Slide 30 text

4. Code exchange (server-side) POST /login/oauth/access_token HTTP/1.1 host: github.com content-type: application/x-www-form-urlencoded grant_type=authorization_code &code=TEMP_CODE_HERE &redirect_uri=https: example.com/callback &client_id=abc123 / / &client_secret=super_secret

Slide 31

Slide 31 text

4. Code exchange (server-side) POST /login/oauth/access_token HTTP/1.1 host: github.com content-type: application/x-www-form-urlencoded grant_type=authorization_code &code=TEMP_CODE_HERE &redirect_uri=https: example.com/callback &client_id=abc123 / / &client_secret=super_secret

Slide 32

Slide 32 text

4. Code exchange (server-side) POST /login/oauth/access_token HTTP/1.1 host: github.com content-type: application/x-www-form-urlencoded grant_type=authorization_code &code=TEMP_CODE_HERE &redirect_uri=https: example.com/callback &client_id=abc123 / / &client_secret=super_secret

Slide 33

Slide 33 text

4. Code exchange (server-side) POST /login/oauth/access_token HTTP/1.1 host: github.com content-type: application/x-www-form-urlencoded grant_type=authorization_code &code=TEMP_CODE_HERE &redirect_uri=https: example.com/callback &client_id=abc123 / / &client_secret=super_secret

Slide 34

Slide 34 text

1 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request User authentication and consent 2 Authorization code redirect 3 4 5 Code exchange (server-side) Access token

Slide 35

Slide 35 text

5. Access token { "access_token": "gho_16C7e42F292c6912E771…", "token_type": "Bearer", "scope": "read:user repo", "expires_in": 3600 }

Slide 36

Slide 36 text

5. Access token { "access_token": "gho_16C7e42F292c6912E771…", "token_type": "Bearer", "scope": "read:user repo", "expires_in": 3600 }

Slide 37

Slide 37 text

5. Access token { "access_token": "gho_16C7e42F292c6912E771…", "token_type": "Bearer", "scope": "read:user repo", "expires_in": 3600 }

Slide 38

Slide 38 text

5. Access token { "access_token": "gho_16C7e42F292c6912E771…", "token_type": "Bearer", "scope": "read:user repo", "expires_in": 3600 }

Slide 39

Slide 39 text

5. Access token { "access_token": "gho_16C7e42F292c6912E771…", "token_type": "Bearer", "scope": "read:user repo", "expires_in": 3600 }

Slide 40

Slide 40 text

1 Browser Client Auth Server Resource Server User App server GitHub GitHub API Client redirect for authorization request User authentication and consent 2 Authorization code redirect 3 4 Code exchange (server-side) 5 Access token 6 Access the resource

Slide 41

Slide 41 text

6. Accessing the resource GET /user HTTP/1.1 host: api.github.com authorization: Bearer gho_16C7e42F292c6912E771…

Slide 42

Slide 42 text

Other grant types Filip Szalbot / Unsplash grant type use case authorization code web apps, mobile apps client credentials machine-to-machine; no user involved device code TVs, CLIs, devices with no browser implicit deprecated, not not use

Slide 43

Slide 43 text

PKCE Authorization Code for Public Clients Proof Key for Code Exchange (RFC 7636) Problem: Some clients can’t keep a secret. • Native mobile apps ship code to the user's device • Single-page apps (SPAs) run in the browser • Any embedded client_secret can be extracted Solution: Replace the secret with a one-time cryptographic challenge. Required in OAuth 2.1. Modun Studio / Pexels

Slide 44

Slide 44 text

You have an access token. Now what?

Slide 45

Slide 45 text

Access tokens The credential your app uses to call an API. Two popular formats: Format How it works Opaque A random string; only the Authorization Server knows what it means JWT Self-contained; the Resource Server can validate it locally Both are short-lived by design. Never store in local storage. Use an HttpOnly cookie or server-side session. Pavel Danilyuk / Pexels

Slide 46

Slide 46 text

Refresh tokens Long-lived credential used to obtain a new access token without sending the user through the consent ow again. POST /login/oauth/access_token HTTP/1.1 host: github.com grant_type=refresh_token &refresh_token=YOUR_REFRESH_TOKEN &client_id=abc123 &client_secret=super_secret Treat like a password. Store securely, encrypted at rest, server-side only. fl Jose Antonio Gallego Vázquez / Unsplash

Slide 47

Slide 47 text

Scopes Scopes are the vocabulary of permission. • Clients request scopes GitHub scopes examples read:user Read your public pro le • Users approve them repo Full access to respositories • Tokens encode what was granted email Read your primary email address openid† OpenID Connect identity Use the principle of least privilege. Request only the scopes you need. fi † GitHub doesn’t actually have the openid scope; we’ll talk more about this in a bit.

Slide 48

Slide 48 text

Token validation On the resource server 1. Is it genuine? 2. Is it still valid? 3. Is it meant for me? 4. Does it grant the right scope? Lucas S / Unsplash

Slide 49

Slide 49 text

And, now, some code… Arif Riyanto / Unsplash

Slide 50

Slide 50 text

Introducing league/oauth2-client It’s the de facto standard for OAuth 2.0 clients in PHP. • Works with or without a framework • Provider packages for GitHub, Google, Facebook, Slack, and dozens more • Handles URL construction, state, token exchange, and API calls composer require league/oauth2-client league/oauth2-github

Slide 51

Slide 51 text

Starting the flow authorize.php — redirect user to GitHub use League\OAuth2\Client\Provider\Github; session_start(); $provider = new Github([ 'clientId' $_ENV['GITHUB_CLIENT_ID'], 'clientSecret' $_ENV['GITHUB_CLIENT_SECRET'], 'redirectUri' 'https: example.com/callback', ]); $authUrl = $provider 'scope' getAuthorizationUrl([ ['read:user', 'repo'], ]); $_SESSION['oauth2state'] = $provider > - / / > > > > - = = = > = header('Location: ' . $authUrl); getState();

Slide 52

Slide 52 text

$provider = new Github([ 'clientId' $_ENV['GITHUB_CLIENT_ID'], 'clientSecret' $_ENV['GITHUB_CLIENT_SECRET'], 'redirectUri' 'https: / / > > > = = = ]); example.com/callback',

Slide 53

Slide 53 text

$authUrl = $provider 'scope' ['read:user', 'repo'], > - > ]); = getAuthorizationUrl([

Slide 54

Slide 54 text

$_SESSION['oauth2state'] = $provider > - header('Location: ' . $authUrl); getState();

Slide 55

Slide 55 text

callback.php — exchange the code, call the API Use session_start() and instantiate GitHub provider (see authorize.php). if (empty($_GET['state']) $_GET['state'] $_SESSION['oauth2state']) { unset($_SESSION['oauth2state']); throw new RuntimeException('Invalid state; possible CSRF attack'); } $token = $provider 'code' getAccessToken('authorization_code', [ $_GET['code'], ]); getResourceOwner($token); getUrl(); = | | > - > . $user - > - > - > = echo 'GitHub: ' getName() . "!\n"; = echo 'Hello, ' . $user ! $user = $provider / / Handling the Callback

Slide 56

Slide 56 text

if ( empty($_GET['state']) $_GET['state'] $_SESSION['oauth2state'] ) { unset($_SESSION['oauth2state']); throw new RuntimeException( 'Invalid state; possible CSRF attack', ); = = ! | | } / / Validate state to prevent CSRF

Slide 57

Slide 57 text

$token = $provider getAccessToken( 'authorization_code', [ 'code' $_GET['code'], ], > - > = ); / / Exchange the authorization code for an access token

Slide 58

Slide 58 text

$user = $provider getResourceOwner($token); echo 'Hello, ' . $user getName() . "!\n"; > - > . $user - > - echo 'GitHub: ' / / Use the token to fetch the user's profile getUrl() . "\n";

Slide 59

Slide 59 text

What the library did The library handled: Task Step Building the authorization URL 1 Generating a state value 1 POSTing to the token endpoint 4 Parsing the token response 5 Sending the Authorization header 6 You handled: con g, verifying state, user data fi ELEVATE / Pexels

Slide 60

Slide 60 text

OAuth 2.0 handles authorization.

Slide 61

Slide 61 text

But who authorized it?

Slide 62

Slide 62 text

OAuth 2.0 grants access to resources. It says nothing about who you are. Every provider does it di erently. ff Mikhail Nilov / Pexels

Slide 63

Slide 63 text

OpenID Connect (OIDC) A thin identity layer on top of OAuth 2.0, standardized by OpenID Foundation Four additions on top of the OAuth 2.0 Authorization Code ow: openid scope Signals to the server: “I want identity, not just access” ID token A JWT containing veri ed identity claims about the user UserInfo endpoint A standard endpoint to fetch additional claims Discovery document A standard URL where the server advertises its capabilities fl What it is fi Addition

Slide 64

Slide 64 text

No content

Slide 65

Slide 65 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 66

Slide 66 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 67

Slide 67 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 68

Slide 68 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 69

Slide 69 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 70

Slide 70 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 71

Slide 71 text

ID token JWT issued with access token (decoded here) { "iss": "https: accounts.google.com", "sub": "1234567890", "aud": "your-client-id", "exp": 1716345600, "iat": 1716342000, "email": "[email protected]", "name": "Ben Ramsey", "picture": "https: / / / / } lh3.googleusercontent.com/photo.jpg"

Slide 72

Slide 72 text

ID token Two important things 1. Always validate it before trusting it. 2. Use sub, not email, as your user identi er. fi Eric Prouzet / Unsplash

Slide 73

Slide 73 text

OAuth 2.0 authorization request https: accounts.google.com/o/oauth2/auth ?response_type=code &client_id=your-client-id &redirect_uri=https: &scope=email%20profile example.com/callback / / / / &state=xK9mQ2

Slide 74

Slide 74 text

OAuth 2.0 + OpenID Connect https: accounts.google.com/o/oauth2/auth ?response_type=code &client_id=your-client-id &redirect_uri=https: example.com/callback &scope=openid%20email%20profile / / / / &state=xK9mQ2

Slide 75

Slide 75 text

OAuth 2.0 + OpenID Connect https: accounts.google.com/o/oauth2/auth ?response_type=code &client_id=your-client-id &redirect_uri=https: example.com/callback &scope=openid%20email%20profile / / / / &state=xK9mQ2

Slide 76

Slide 76 text

Sign in with… Google. Apple. GitHub. These are all OAuth 2.0 + OpenID Connect. OIDC is the standard that makes them work the same way everywhere: • Same openid scope trigger • Same ID token format (JWT) • Same claims (sub, email, name, picture, etc.) • Same validation steps Enterprise Single Sign-On (SSO) is built on OIDC.

Slide 77

Slide 77 text

Putting it all together El Jundi / Pexels

Slide 78

Slide 78 text

OAuth 2.0 OpenID Connect “I authorize this app to act on my behalf.” “I authorize this app to act on my behalf, and here’s who I am.”

Slide 79

Slide 79 text

When to use which Scenario Use Call a third-party API (GitHub, Stripe, Slack) on behalf of a user OAuth 2.0 Build login or SSO OpenID Connect (which is OAuth + identity) Service-to-service API calls with no user Client Credentials ow SPA or mobile app authenticating a user Authorization Code + PKCE When in doubt: if a human is logging in, use OIDC. fl (i.e., Authorization Code + PKCE)

Slide 80

Slide 80 text

fi Don’t reinvent the wheel OAuth 2.0 client (PHP) ID token validation (PHP) Running your own authorization server • league/oauth2-client • league/oauth2-github • league/oauth2-google, etc. • facile-it/php-openid-client • rebase/php-jwt • hybridauth/hybridauth • jumbojett/openid-connect-php • league/oauth2-server (PHP, self-hosted) • Keycloak (open source, self-hosted) • Auth0 / Okta (managed, enterprise-grade)

Slide 81

Slide 81 text

Common gotchas Skipping state validation Always verify state matches what you stored; it’s your CSRF protection Trusting the ID token without validating it Always verify signature, iss, aud, and exp before reading claims Storing sub but keying on email Use sub (+ iss) as your user identi er; email addresses change Putting tokens in localStorage Use HttpOnly cookies or server-side sessions; localStorage is XSS-accessible Using the Implicit ow Don’t. It’s deprecated. Use Authorization Code + PKCE instead. HTTP in development Always use HTTPS, even locally if possible; tokens in transit must be protected fi What to do fl Gotcha

Slide 82

Slide 82 text

Resources Start here: • oauth.net — approachable guides, spec links, news • jwt.io — paste any JWT and see it decoded instantly The specs: • RFC 6749 — OAuth 2.0 Authorization Framework • OpenID Connect Core 1.0 - the OIDC spec • RFC 7636 — PKCE

Slide 83

Slide 83 text

 Thank you! Keep in touch ben.ramsey.dev  phpc.social/@ramsey  github.com/ramsey  www.linkedin.com/in/benramsey [email protected] A Beginner’s Guide to OAuth and OpenID Connect Copyright © 2026 Ben Ramsey This work is licensed under Creative Commons Attribution-ShareAlike 4.0 International. For uses not covered under this license, please contact the author. Ramsey, Ben. “A Beginner’s Guide to OAuth and OpenID Connect.” Longhorn PHP Conference, 16 Oct. 2026, Holiday Inn Austin Midtown, Austin, TX.