Laravel wrapper around OAuth 1 & OAuth 2 libraries.

Since the announcement of sign in with apple id. It'd be good to have it as a socialite provider for sign in with apple.

https://developer.apple.com/sign-in-with-apple/

• Socialite Version: ^4.1,
• Laravel Version: 5.8
• PHP Version: 7. 2.18
• Database Driver & Version:

Description:

Specifically for Google (Facebook works) I get an InvalidStateException .

However if I comment out profile in $scopes array in file /vendor/laravel/socialite/src/Two/GoogleProvider.php

so it looks like:

protected $scopes = [
        'openid',
        //'profile',
        'email',
    ];

Then login works, however then I don't have access to name which I really need.

I got this issue ones i upload to the server:

Client error: POST https://accounts.google.com/o/oauth2/token resulted in a 400 Bad Request response: { "error": "invalid_request", "error_description": "Missing required parameter: code" }

any solution, thx in advance.

• Socialite Version: 5.2.0
• Laravel Version: 8.28.1
• PHP Version: 7.4.12
• Database Driver & Version: mysql driver, MySQL 8

Description:

We have a stateless application, which provides the only API enpoints. This means we don't have any sessions inside. After update to 5.2.0 and using Google auth we now get the fatal error on the endpoint, which returns auth URLs for social networks.

Laravel fatal response:

Sentry debug backtrace:

Steps To Reproduce:

• Create REST application, without session
• Try to get Google redirect URL

• Socialite Version: v5.0.1
• Laravel Version: v8.4.0
• PHP Version: v7.3.11
• Database Driver & Version: MySQL

Description:

The getAvatar() method doesn't return the publicly available profile image URL. It assumes size/type = normal, which is fine, but it lacks the access token, thus returning the default Facebook "no profile image" image.

If one is to retrieve the avatar, one must append &access_token=XXXXXXXX... to the getAvatar(), which is not at all obvious. Shouldn't the getAvatar() return the public image by default, or at least have the boolean parameter to choose this?

Steps To Reproduce:

Just call the Socialite::driver('facebook')->user()->getAvatar() in the handleProviderCallback.

I got this error when I try to login with my LinkedIn Account laravel/socialite": "^3.1"

and here is script $userSocial = Socialite::driver('linkedin')->user();

here is the developer update from linkedin (https://engineering.linkedin.com/blog/2018/12/developer-program-updates)

Client error: GET https://api.linkedin.com/v1/people/~:(id,first-name,last-name,formatted-name,email-address,headline,location,industry,public-profile-url,picture-url,picture-urls::(original)) resulted in a 410 Gone response: { "errorCode": 0, "message": "This resource is no longer available under v1 APIs", "requestId": "3WIBWBXOPW", "s (truncated...)

How to fix this issue ?

Thank you

I have general routes to allow easily adding Socialite providers:

Route::get('login/{provider}', 'Auth\LoginController@redirectToProvider')->name('socialite.redirect');  
Route::get('login/{provider}/callback', 'Auth\LoginController@handleProviderCallback')->name('socialite.callback');

Because config is loaded before routes, it isn't possible to set the redirect option in services.php using something like route('socialite.callback', ['provider' => 'google']),.

My proposal is to allow setting a route name for Socialite and use that to create a default redirect if one isn't specified.

Something like this (although there isn't currently a simple way to get the provider name either?):

    /**
     * Format the callback URL, resolving a relative URI if needed.
     *
     * @param  array  $config
     * @return string
     */
    protected function formatRedirectUrl(array $config)
    {
        $redirect = value($config['redirect']);
        if ( ! defined($redirect) ) {
            return $this->defaultRedirectUrl($config);
        }
        return Str::startsWith($redirect, '/')
                    ? $this->app['url']->to($redirect)
                    : $redirect;
    }

    /**
     * Get a default callback route.
     *
     * @param  array  $config
     * @return string
     */
    protected function defaultRedirectUrl(array $config)
    {
        $socialite_config = $this->app['config']['socialite'];
        $route = value($config['route']);
        if ($route) {
            return $this->app['url']->route($route, ['provider' => $config['provider'] ]);
        } else {
            throw new Exception();
        }
    }

• Socialite Version: 4.1
• Laravel Version: 5.8
• PHP Version: 7.1

Description:

When using linkedIn with scopes, the scope is requested, however the data is not getting fetched afterwards. When I for example have the scope r_basicprofile, I should be able to get the vanityName, however this data is not getting fetched.

Looking into the provider, we have a bunch of hardcoded properties, these do not change depending on which scope I am requesting.

Steps To Reproduce:

Make a request with scope r_basicprofile.

Many OAuth providers support the PKCE extension, so it would be great to see this added in the core OAuth 2 class so that it can be leveraged by providers.

While PKCE was originally created for native apps, it also protects against authorization code injection even for web server apps that use a client secret.

How to implement:

• Generate a new random string and store it in the session similar to how Socialite currently stores the state value.
• Then generate a SHA256 hash of that string and include that in the getCodeFields parameters.
• Include the original random string in the getTokenFields POST request.

• Socialite Version: 3.2.0
• Laravel Version: 5.7.28
• PHP Version: 7.1.23
• Database Driver & Version: Postgres 10.6

Description:

It seems Facebook’s changed how it returns access tokens since Socialite was last updated and the expiration date is no longer surfaced (and therefore set by Socialite). It’s also unclear whether the token Socialite returns is a “short-lived” token or a “long-lived” token.

It is possible to “debug” a Facebook access token: (https://developers.facebook.com/docs/graph-api/reference/v3.2/debug_token). But again, this is confusing as that endpoint returns two “expires” timestamps: an expires_at timestamp and a data_access_expires_at timestamp.

I’m not sure whether it would be acceptable for Socialite to make a second HTTP call just to fetch the expires_at timestamp value, but it sure would be helpful in my application(s) so that for stored access tokens, I can see when they expired and if they need refreshing.

Steps To Reproduce:

1. Create a route to authenticate with Facebook.
2. Create a route to handle the callback from Facebook.
3. Observe that expiresIn is null when calling Socialite::driver('facebook')->user().

Hi,

I'm still using laravel 5.4 for php version reason. But, I got an email which saying that Google+ APIs being shutdown. But, unfortunately the changes are made for v4. Could you help me how I can use the changes which made in #283 for v3 ?

Thanks