PHP Web应用集成Google登录按钮时verifyIdToken()步骤失败求助

问题描述 #

PHP项目集成Google Identity Services登录功能，已成功显示登录按钮并接收前端传递的ID Token，但调用Google\Client->verifyIdToken()验证Token时，出现Guzzle无法读取流的致命错误，具体报错如下：

[Wed Mar 15 12:29:59.074744 2023] [php:error] [pid 71] [client 172.17.0.1:43470] PHP Fatal error:  Uncaught RuntimeException: Unable to read from stream in /var/www/html/vendor/guzzlehttp/psr7/src/Stream.php:237
Stack trace:
#0 /var/www/html/vendor/guzzlehttp/psr7/src/Utils.php(53): GuzzleHttp\Psr7\Stream->read()
#1 /var/www/html/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php(210): GuzzleHttp\Psr7\Utils::copyToStream()

#13 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(173): GuzzleHttp\Client->get()
#14 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(201): Google\AccessToken\Verify->retrieveCertsFromLocation()
#15 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(105): Google\AccessToken\Verify->getFederatedSignOnCerts()
#16 /var/www/html/vendor/google/apiclient/src/Client.php(815): Google\AccessToken\Verify->verifyIdToken()
#17 /var/www/html/siohub/public/web/login.php(62): Google\Client->verifyIdToken()
#18 {main}

Next GuzzleHttp\Exception\RequestException: Unable to read from stream in /var/www/html/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:52
Stack trace:
#10 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(173): GuzzleHttp\Client->get()
#11 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(201): Google\AccessToken\Verify->retrieveCertsFromLocation()
#12 /var/www/html/vendor/google/apiclient/src/AccessToken/Verify.php(105): Google\AccessToken\Verify->getFederatedSignOnCerts()
#13 /var/www/html/vendor/google/apiclient/src/Client.php(815): Google\AccessToken\Verify->verifyIdToken()
#14 /var/www/html/siohub/public/web/login.php(62): Google\Client->verifyIdToken()
#15 {main}
  thrown in /var/www/html/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php on line 52, referer: http://localhost:8081/siohub/public/web/login.html

解决办法 #

1. 检查服务器网络连通性 #

验证服务器是否能访问Google的证书分发地址：

curl https://www.googleapis.com/oauth2/v3/certs

如果无法访问，需排查：

• 服务器是否有防火墙/安全组限制出站请求
• 国内服务器需配置代理，可在Guzzle客户端中设置代理：

$client = new Google\Client();
$client->setHttpClient(new GuzzleHttp\Client([
    'proxy' => 'http://your-proxy-ip:port',
]));

2. 修复SSL根证书问题 #

服务器缺失可信根证书，导致无法验证Google的SSL证书：

• Ubuntu/Debian系统更新CA证书：

apt update && apt install --reinstall ca-certificates

• CentOS/RHEL系统：

yum update ca-certificates

注意：生产环境不要禁用SSL验证，这会带来安全风险

3. 更新依赖包版本 #

Google Client和Guzzle版本不兼容可能导致该问题，执行更新：

composer update google/apiclient guzzlehttp/guzzle

4. 检查临时目录权限 #

Guzzle需要读写临时文件，确保PHP进程对临时目录有读写权限：

• 查看PHP临时目录路径：

echo sys_get_temp_dir();

• 调整目录权限（假设临时目录为/tmp）：

chmod 777 /tmp
chown www-data:www-data /tmp # 根据你的PHP进程用户调整

内容的提问来源于stack exchange，提问作者mp30028