PHP應(yīng)用
web
├─ common
│ └─ models 
│ └ User.php
└─ frontend
├─ config
│ └ main.php
└─ controllers
└ BookController.php

PHP應(yīng)用
namespace frontend\controllers;
use yii\rest\ActiveController;
use yii\web\Response;
class BookController extends ActiveController
{
public $modelClass = 'frontend\models\Book';
public function behaviors() {
$behaviors = parent::behaviors();
$behaviors['contentNegotiator']['formats']['text/html'] = Response::FORMAT_JSON;
return $behaviors;
}
}

PHP應(yīng)用
'components' => [
...
'user' => [
'identityClass' => 'common\models\User',
'enableAutoLogin' => true,
'enableSession' => false,
'loginUrl' => null,
],
...
]

PHP應(yīng)用
namespace frontend\controllers;
use yii\rest\ActiveController;
use yii\web\Response;
use yii\filters\auth\CompositeAuth;
use yii\filters\auth\QueryParamAuth;
class BookController extends ActiveController
{
public $modelClass = 'frontend\models\Book';
public function behaviors() {
$behaviors = parent::behaviors();
$behaviors['authenticator'] = [
'class' => CompositeAuth::className(),
'authMethods' => [
/*下面是三種驗(yàn)證access_token方式*/
//1.HTTP 基本認(rèn)證: access token 當(dāng)作用戶名發(fā)送,應(yīng)用在access token可安全存在API使用端的場(chǎng)景,例如,API使用端是運(yùn)行在一臺(tái)服務(wù)器上的程序.
//HttpBasicAuth::className(),
//2.OAuth 2: 使用者從認(rèn)證服務(wù)器上獲取基于OAuth2協(xié)議的access token,然后通過(guò) HTTP Bearer Tokens 發(fā)送到API 服務(wù)器.
//HttpBearerAuth::className(),
//3.請(qǐng)求參數(shù): access token 當(dāng)作API URL請(qǐng)求參數(shù)發(fā)送,這種方式應(yīng)主要用于JSONP請(qǐng)求,因?yàn)樗荒苁褂肏TTP頭來(lái)發(fā)送access token
//http://localhost/user/index/index?access-token=123
QueryParamAuth::className(),
],
];
$behaviors['contentNegotiator']['formats']['text/html'] = Response::FORMAT_JSON;
return $behaviors;
}
}

PHP應(yīng)用
-- ----------------------------
-- Table structure for user
-- ----------------------------
DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
`username` varchar(20) NOT NULL DEFAULT '' COMMENT '用戶名',
`password_hash` varchar(100) NOT NULL DEFAULT '' COMMENT '密碼',
`password_reset_token` varchar(50) NOT NULL DEFAULT '' COMMENT '密碼token',
`email` varchar(20) NOT NULL DEFAULT '' COMMENT '郵箱',
`auth_key` varchar(50) NOT NULL DEFAULT '',
`status` tinyint(3) unsigned NOT NULL DEFAULT '0' COMMENT '狀態(tài)',
`created_at` int(10) unsigned NOT NULL DEFAULT '0' COMMENT '創(chuàng)建時(shí)間',
`updated_at` int(10) unsigned NOT NULL DEFAULT '0' COMMENT '更新時(shí)間',
`access_token` varchar(50) NOT NULL DEFAULT '' COMMENT 'restful請(qǐng)求token',
`allowance` int(10) unsigned NOT NULL DEFAULT '0' COMMENT 'restful剩余的允許的請(qǐng)求數(shù)',
`allowance_updated_at` int(10) unsigned NOT NULL DEFAULT '0' COMMENT 'restful請(qǐng)求的UNIX時(shí)間戳數(shù)',
PRIMARY KEY (`id`),
UNIQUE KEY `username` (`username`),
UNIQUE KEY `access_token` (`access_token`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
-- ----------------------------
-- Records of user
-- ----------------------------
INSERT INTO `user` VALUES ('1', 'admin', '$2y$13$1KWwchqGvxDeORDt5pRW.OJarf06PjNYxe2vEGVs7e5amD3wnEX.i', '', '', 'z3sM2KZvXdk6mNXXrz25D3JoZlGXoJMC', '10', '1478686493', '1478686493', '123', '4', '1478686493');

PHP應(yīng)用
public static function findIdentityByAccessToken($token, $type = null)
{
//findIdentityByAccessToken()方法的實(shí)現(xiàn)是系統(tǒng)定義的
//例如,一個(gè)簡(jiǎn)單的場(chǎng)景,當(dāng)每個(gè)用戶只有一個(gè)access token, 可存儲(chǔ)access token 到user表的access_token列中, 方法可在User類中簡(jiǎn)單實(shí)現(xiàn),如下所示：
return static::findOne(['access_token' => $token]);
//throw new NotSupportedException('"findIdentityByAccessToken" is not implemented.');
}

PHP應(yīng)用
namespace frontend\controllers;
use yii\rest\ActiveController;
use yii\web\Response;
use yii\filters\auth\CompositeAuth;
use yii\filters\auth\QueryParamAuth;
use yii\filters\RateLimiter;
class BookController extends ActiveController
{
public $modelClass = 'frontend\models\Book';
public function behaviors() {
$behaviors = parent::behaviors();
$behaviors['rateLimiter'] = [
'class' => RateLimiter::className(),
'enableRateLimitHeaders' => true,
];
$behaviors['authenticator'] = [
'class' => CompositeAuth::className(),
'authMethods' => [
/*下面是三種驗(yàn)證access_token方式*/
//1.HTTP 基本認(rèn)證: access token 當(dāng)作用戶名發(fā)送,應(yīng)用在access token可安全存在API使用端的場(chǎng)景,例如,API使用端是運(yùn)行在一臺(tái)服務(wù)器上的程序.
//HttpBasicAuth::className(),
//2.OAuth 2: 使用者從認(rèn)證服務(wù)器上獲取基于OAuth2協(xié)議的access token,然后通過(guò) HTTP Bearer Tokens 發(fā)送到API 服務(wù)器.
//HttpBearerAuth::className(),
//3.請(qǐng)求參數(shù): access token 當(dāng)作API URL請(qǐng)求參數(shù)發(fā)送,這種方式應(yīng)主要用于JSONP請(qǐng)求,因?yàn)樗荒苁褂肏TTP頭來(lái)發(fā)送access token
//http://localhost/user/index/index?access-token=123
QueryParamAuth::className(),
],
];
$behaviors['contentNegotiator']['formats']['text/html'] = Response::FORMAT_JSON;
return $behaviors;
}
}

PHP應(yīng)用
namespace common\models;
use Yii;
use yii\base\NotSupportedException;
use yii\behaviors\TimestampBehavior;
use yii\db\ActiveRecord;
use yii\web\IdentityInterface;
use yii\filters\RateLimitInterface;
class User extends ActiveRecord implements IdentityInterface, RateLimitInterface
{
....
// 返回在單位時(shí)間內(nèi)允許的請(qǐng)求的最大數(shù)目,例如,[10, 60] 表示在60秒內(nèi)最多請(qǐng)求10次.
public function getRateLimit($request, $action)
{
return [5, 10];
}
// 返回剩余的允許的請(qǐng)求數(shù).
public function loadAllowance($request, $action)
{
return [$this->allowance, $this->allowance_updated_at];
}
// 保存請(qǐng)求時(shí)的UNIX時(shí)間戳.
public function saveAllowance($request, $action, $allowance, $timestamp)
{
$this->allowance = $allowance;
$this->allowance_updated_at = $timestamp;
$this->save();
}
....
public static function findIdentityByAccessToken($token, $type = null)
{
//throw new NotSupportedException('"findIdentityByAccessToken" is not implemented.');
//findIdentityByAccessToken()方法的實(shí)現(xiàn)是系統(tǒng)定義的
//例如,一個(gè)簡(jiǎn)單的場(chǎng)景,當(dāng)每個(gè)用戶只有一個(gè)access token, 可存儲(chǔ)access token 到user表的access_token列中, 方法可在User類中簡(jiǎn)單實(shí)現(xiàn),如下所示：
return static::findOne(['access_token' => $token]);
}
....
}