Yoast\WP\SEO\MyYoast_Client\Application

Authorization_Code_Handler::exchange_code │ public │ Yoast 1.0

Exchanges an authorization code for tokens.

Validates the state parameter (CSRF), exchanges the code for tokens, and validates the ID token nonce (replay protection) if present.

Метод класса: Authorization_Code_Handler{}

Хуков нет.

Возвращает

Token_Set. The obtained tokens.

Использование

$Authorization_Code_Handler = new Authorization_Code_Handler();
$Authorization_Code_Handler->exchange_code( $user_id, $code, $state ): Token_Set;

$user_id(int) (обязательный)

The WordPress user ID.

$code(строка) (обязательный)

The authorization code from the callback.

$state(строка) (обязательный)

The state parameter from the callback.

Код Authorization_Code_Handler::exchange_code() Authorization Code Handler::exchange code ^{Yoast 28.3}

public function exchange_code( int $user_id, string $code, string $state ): Token_Set {
	if ( $user_id <= 0 ) {
		throw new Token_Request_Failed_Exception( 'invalid_user', 'A valid WordPress user ID is required to exchange an authorization code.' );
	}

	$flow_state = $this->get_flow_state( $user_id );

	// Validate state (CSRF protection).
	if ( ! \hash_equals( $flow_state->get_state(), $state ) ) {
		$this->logger->warning( 'Authorization code exchange failed: state parameter mismatch for user {user_id} (potential CSRF).', [ 'user_id' => $user_id ] );
		$this->discard_flow_state( $user_id );
		throw new Token_Request_Failed_Exception( 'invalid_request', 'State parameter mismatch.' );
	}

	// Clean up the stored flow state.
	$this->discard_flow_state( $user_id );

	$resource_indicator = $flow_state->get_resource_indicator();
	$grant              = new Authorization_Code_Grant( $code, $flow_state->get_redirect_uri(), $flow_state->get_code_verifier() );
	$token_set          = $this->grant_handler->request_token( $grant, $resource_indicator );

	// Validate ID token nonce (replay protection) if an ID token was returned.
	$this->validate_id_token_nonce( $token_set, $flow_state );

	$this->client_registration->mark_uri_validated( $flow_state->get_redirect_uri() );

	return $token_set;
}