Yii2 API双身份认证方案咨询：网站与用户OAuth认证实现

Hey Eduardo, let's walk through your questions and your current setup clearly:

1. Is your current API solution reasonable, and are tokens mandatory for data access? #

First off, your dual-authentication approach (validating the connected website first, then the logged-in user within that site) is perfectly aligned with your multi-site, independent user base scenario—it’s a solid, logical setup.

As for whether tokens are mandatory:

• Yes, they absolutely are. If you passed api_key and api_secret with every request, you’d be exposing sensitive credentials far more often than necessary, drastically increasing the risk of interception or theft. Short-lived access_tokens limit this risk to their validity window, and the ability to refresh them means you don’t have to re-expose long-term secrets.
• Tokens also enable stateless authentication (especially if you use JWT instead of session storage), which makes your API more scalable for multiple site integrations—your service doesn’t need to track session states for every connected website.

A small optimization: You’re currently storing the website’s access_token in a SESSION. Consider using HttpOnly, Secure cookies instead—they’re more resistant to XSS attacks that could steal token data.

2. How to use Bearer Tokens to handle both website access and user permission authentication? #

Yii2’s CompositeAuth supports multiple authentication methods at once, so you can extend it to validate both website and user identities. Here are two practical approaches:

Option 1: Dual-header token validation #

Split the website and user tokens into separate request headers, then validate both sequentially:

1. Create a custom website authentication class
   This class will check a dedicated header (e.g., X-Website-Access-Token) to validate the connected site:

namespace app\filters\auth;

use yii\filters\auth\AuthMethod;
use yii\web\UnauthorizedHttpException;
use app\models\Website;

class WebsiteAuth extends AuthMethod
{
    public function authenticate($user, $request, $response)
    {
        $token = $request->getHeaders()->get('X-Website-Access-Token');
        if (empty($token)) {
            throw new UnauthorizedHttpException('Website token cannot be empty');
        }
        
        $website = Website::findOne(['access_token' => $token]);
        if (!$website || $website->expiration_token < time()) {
            throw new UnauthorizedHttpException('Invalid or expired website token');
        }
        
        // Store the validated website instance for later use in business logic
        \Yii::$app->request->set('website', $website);
        return true; // Website authentication passed
    }
}

2. Update your User Controller's behaviors
   Add both the custom website auth and user Bearer auth to the CompositeAuth setup:

public function behaviors()
{
    $behaviors = parent::behaviors();
    $behaviors['authenticator'] = [
        'class' => CompositeAuth::className(),
        'authMethods' => [
            \app\filters\auth\WebsiteAuth::className(), // Validate website first
            HttpBearerAuth::className(), // Then validate user Bearer Token
        ],
    ];
    return $behaviors;
}

Now every request needs to include two headers:

• X-Website-Access-Token: [your website's access token]
• Authorization: Bearer [user's access token]

Option 2: Single Bearer Token with dual identity (JWT) #

If you prefer a single token, encode both website and user data into a JWT, then validate both identities in one step:

// When generating the token, include both website and user IDs in the payload
$payload = [
    'website_id' => $website->id,
    'user_id' => $user->id,
    'exp' => time() + 3600 * 24 * 7, // 7-day expiration
];
$jwt = Yii::$app->jwt->encode($payload);

// Custom authentication class to decode and validate the JWT
public function authenticate($user, $request, $response)
{
    $tokenHeader = $request->getHeaders()->get('Authorization');
    if (!$tokenHeader || strpos($tokenHeader, 'Bearer ') === false) {
        throw new UnauthorizedHttpException('Invalid token format');
    }
    $jwt = substr($tokenHeader, 7);
    
    try {
        $payload = Yii::$app->jwt->decode($jwt);
    } catch (\Exception $e) {
        throw new UnauthorizedHttpException('Invalid token');
    }
    
    // Validate the website exists
    $website = Website::findOne($payload['website_id']);
    if (!$website) {
        throw new UnauthorizedHttpException('Website not found');
    }
    
    // Validate the user belongs to this website
    $userModel = \app\models\User::findOne(['id' => $payload['user_id'], 'website_id' => $website->id]);
    if (!$userModel) {
        throw new UnauthorizedHttpException('Invalid user or user does not belong to this website');
    }
    
    return $userModel;
}

This approach is cleaner, but make sure to secure your JWT signing key and follow best practices for token expiration.

内容的提问来源于stack exchange，提问作者Eduardo