Download the PHP package exceed/exauth-oauth without Composer
On this page you can find all versions of the php package exceed/exauth-oauth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download exceed/exauth-oauth
More information about exceed/exauth-oauth
Files in exceed/exauth-oauth
Package exauth-oauth
Short Description Social login (Google) for exAuth - CodeIgniter 4 authentication library.
License MIT
Informations about the package exauth-oauth
exauth-oauth
Social login (Google) for exAuth — the CodeIgniter 4 authentication library.
Status: Phase 1 — Google only. GitHub / Facebook will follow in phase 2. Compatible with
exceed/exauth ^1.4.
This is a separate package — it does NOT modify the core exceed/exauth
library. It only adds an OAuth identity type, controllers, routes, and a service.
Features
- Login with Google (OpenID Connect)
- Account linking — if the Google email is already registered, the user is asked for their local password to "link" the accounts (prevents account takeover)
- State + PKCE protection (CSRF-safe)
- Tokens stored in
auth_identities.extras(safe, not truncated) - OAuth users are created automatically with a placeholder password +
status = 'oauth'
Install
Setup
Option A — Automatic (recommended)
This creates app/Config/OAuth.php with the correct Config namespace that
extends the package base config. Use -f to overwrite an existing file.
Option B — Manual
Create app/Config/OAuth.php (must use the Config namespace and extend the
package base config — NOT a plain copy of the vendor file, which would clash):
⚠️ Do NOT
cp vendor/exceed/exauth-oauth/src/Config/OAuth.php app/Config/OAuth.phpas-is — that file uses namespaceexAuthOauth\Config, which collides with the package's own class and causes a fatal error. Always create the app config withnamespace Configandextends exAuthOauth\Config\OAuth(thepublishcommand does this for you).
-
Fill in your Google credentials (from Google Cloud Console) in the
googlearray above. - Register the routes in
app/Config/Routes.php:
service('oauth')returns theexAuthOauth\Authfacade (which hasoauthRoutes()). The OAuth provider itself isservice('oauthProvider').
- Add the button to your login view:
The button only appears when
enabled = trueinapp/Config/OAuth.php. When disabled, the snippet returns an empty string — no need to remove the code.
How it works
Security
| Risk | Mitigation |
|---|---|
| CSRF on callback | Required state (checked against session) |
| Account takeover | Account linking required, no auto-create |
| Token too long | Stored in extras (TEXT) |
Managing links via CLI
Roadmap
- [ ] Phase 2: GitHub (
league/oauth2-github) - [ ] Phase 2: Facebook (
league/oauth2-facebook) - [ ] "Set password" for
status = 'oauth'accounts
Guide
- Beginner: see
docs/EXAUTH_BEGINNER_OAUTH_SETUP.md— from zero to logging in with Google, including prerequisites (install exAuth first, then Google Cloud Console).
License
MIT