SIMON Master Console Rebuild

File viewer

guarded to /htdocs

/api/auth/apple_start.php

<?php
declare(strict_types=1);

require_once __DIR__ . '/session_bootstrap.php';

if (!defined('APPLE_CLIENT_ID') || !defined('APPLE_REDIRECT_URI')) {
    guardian_fail('config_error', 'Apple OAuth not configured.');
}

$redirect = guardian_capture_redirect_from_request();

$state = bin2hex(random_bytes(32));
$nonce = bin2hex(random_bytes(32));

if (!isset($_SESSION['oauth_states']) || !is_array($_SESSION['oauth_states'])) {
    $_SESSION['oauth_states'] = [];
}

$_SESSION['oauth_states'][$state] = [
    'provider'   => 'apple',
    'nonce'      => $nonce,
    'created_at' => time(),
    'redirect'   => $redirect,
];

$_SESSION['oauth_provider'] = 'apple';
$_SESSION['oauth_started_at'] = time();
$_SESSION['post_auth_redirect'] = $redirect;

guardian_log_event('oauth_start_debug', [
    'provider'         => 'apple',
    'redirect'         => $redirect,
    'session_name'     => session_name(),
    'session_id'       => session_id(),
    'oauth_state_keys' => array_keys($_SESSION['oauth_states']),
    'cookie_params'    => session_get_cookie_params(),
    'cookies_in_request' => $_COOKIE,
]);

/*
 * Important:
 * Apple requires form_post when requesting name/email.
 * Keep form_post.
 * Write session before redirect so oauth_states is persisted.
 */
session_write_close();

$params = [
    'response_type' => 'code id_token',
    'response_mode' => 'form_post',
    'client_id'     => APPLE_CLIENT_ID,
    'redirect_uri'  => APPLE_REDIRECT_URI,
    'scope'         => 'name email',
    'state'         => $state,
    'nonce'         => $nonce,
];

$url = 'https://appleid.apple.com/auth/authorize?' . http_build_query($params, '', '&', PHP_QUERY_RFC3986);
guardian_redirect($url);

Quick jump

open a path

True command center for SIMON + WEB360

File viewer

Quick jump