Can't detect callback is originated from provider in Laravel Socialite

Question

In Socialite documentation, it says the following line gets the user information:

$user = Socialite::driver('twitter')->user();

This naturally assumes that the callback were originated from Twitter. However, callback route is requested unintentionally in some cases, and the line above gives the error like that:

InvalidArgumentException in TwitterProvider.php line 15:
Invalid request. Missing OAuth verifier.

How can I detect the callback is originated from expected place (it is Twitter here) prior to executing the line above? My log file is full of these error messages. I think these errors come from search engine bots requesting callback route (Auth mechanism seems to work properly).

score 1 · Answer 1 · answered May 21 '17 at 09:30

Here are two solutions for you, one that is exactly what you are asking for (if I did not misunderstand you question), and one to just catch the error raised.

Checking the referrer URL

It seems the issue you are trying to solve is prevent users to open the callback methods in your controller verifying the referrer of the call. If this is what you are trying to achieve, you can proceed retrieving the HTTP Referrer with

$referrer = Request::server('HTTP_REFERER');

Parse the $referrer and see if it correspond to what you need (ex github.com)

$host = parse_url($referrer, PHP_URL_HOST);
if(strpos($host, 'github.com') !== false) {
   // your code here
}

So, the full method could be something like this

public function callback()
{
    $referrer = Request::server('HTTP_REFERER');
    if($referrer) {
        $host = parse_url($referrer, PHP_URL_HOST);
        if(strpos($host, 'github.com') !== false) {
            $user = Socialite::driver('github')->user();
            // your code here
        }
    }
}

Catching the InvalidArgumentException error

Another way to get rid of the error, that may be a better choice is to cage your code in a try/catch block, like this

public function callback()
{
    try {
        $user = Socialite::driver('github')->user();
    } catch (InvalidArgumentException $e) {
        // what will you do if the token is not set?
    }
}

I tried your second solution, but try/cache is not working. The same error message occurs (I added full error message to the question). — horse, May 21 '17 at 18:54
@horse, did you try catching general exception? I just run a fresh install of laravel, installed Socialite, create just the "callback" function and to me it's perfectly working... — Simone Cabrino, May 23 '17 at 09:40

score 1 · Answer 2 · answered May 23 '17 at 08:25

When working with twitter, redirect URL handled by twitter will send two query parameters oauth_token and oauth_verifier.

So you can add route validation to check that the URL contains the parameters.

Solution

In controller add the validation

public function yourcallbackfunction()
{
      $v = \Validator::make(request()->all(), [
           'oauth_token' => 'required',
           'oauth_verifier' => 'required'
      ];

     if($v->fails()) {
         //do something as it's not a valid twitter callback
     }else {
         $user = Socialite::driver('twitter')->user();
     }

}

NOTE:

It's better to handle the socialite call within a try catch to catch other errors that might be thrown by the socialite like invalid token errors or communication error on api.

score 0 · Answer 3 · answered Jan 22 '19 at 16:53

0

I think it should catch general errors.

    try {
        $user = Socialite::driver('twitter')->user();
    } catch (\Exception $e) {
        # do something if nothing works
    }

answered Jan 22 '19 at 16:53

KirtJ

550
7
7

score -1 · Answer 4 · edited May 14 '17 at 13:30

-1

$socialAccount = Socialite::driver('github')->user();

If you want the account details of the currently authenticated user, use the same old

$user = Auth::user();

edited May 14 '17 at 13:30

Mark Rotteveel

100,966
191
140
197

answered May 14 '17 at 07:26

RïshïKêsh Kümar

4,734
1
24
36

https://blog.damirmiladinov.com/laravel/laravel-5.2-socialite-twitter-login.html#.WRgHlVWGOUk ... – RïshïKêsh Kümar May 14 '17 at 07:31
Your answer seems not related to my question. – horse May 14 '17 at 15:12

Henry Bui · Answer 5 · 2017-05-18T07:14:38.233

-1

I really don't understand too much about your question. But I guess that you want to get the Provider name.

Routes should provide the name of provider(github, facebook, google)

Route::get('/redirect/{provider}', [
    'as' => 'getSocialAuthRedirect',
    'uses' => 'Auth\SocialAuthController@redirect'
]);
Route::get('/callback/{provider}', [
    'as' => 'getSocialAuthCallback',
    'uses' => 'Auth\SocialAuthController@callback'
]);

And in controller you can get provider name

public function callback($provider)
{
    // get provider and do something
}

If you want detect callback from github, just need check $provider == 'GithubProvider'

Hope it help!

edited May 18 '17 at 07:14

answered May 18 '17 at 06:50

Henry Bui

423
3
17

My problem occurs when the callback route isn't called by provider. My log file is full of error messages. I think these errors come from search engins bots. Because twitter auth mechanism seems to work properly. – horse May 21 '17 at 18:57
I don't know, did you check was routes call right provider method? Remove all of code, just echo '123' – Henry Bui May 24 '17 at 02:18

Can't detect callback is originated from provider in Laravel Socialite

5 Answers5

Checking the referrer URL

Catching the InvalidArgumentException error

Solution

NOTE:

Linked