Used to maintain the status of requests and callbacks, and bring them back to the third party as they are after authorizing the request. This parameter can be used to prevent CSRF attacks (cross-site request forgery attacks). It is recommended that third parties bring this parameter. It can be set to a simple random number plus session for verification

##No

# at the bottom of the document

Parameter Description

Step 2: Get access_token through code

Get access_token through code

https://api.weixin.qq.com/sns/oauth2/access_token?appid=APPID&secret=SECRET&code=CODE&grant_type=authorization_code

Parameter Description

Correct return:

"access_token":"ACCESS_TOKEN", "expires_in":7200, &lt;br/&gt;"refresh_token":"REFRESH_TOKEN",<br/>"openid":"OPENID", &lt;br/&gt;"scope":"SCOPE","unionid":"o6_bmasdasdsad6_2sgVt7hMZOPfL"}<br/><br/>

1. If the access_token has timed out, then refresh_token will get a new access_token with a new timeout time;

Return instructions

Correct return:

{ <br/>"access_token":"ACCESS_TOKEN", <br/>"expires_in":7200, <br/>"refresh_token ":"REFRESH_TOKEN", <br/>"openid":"OPENID", <br/>"scope":"SCOPE" <br/>}

Note:

1. Appsecret is the key used by the application interface. If leaked, it may lead to application data leakage, application High-risk consequences such as user data leakage; stored on the client, it is very likely to be maliciously stolen (such as decompiling to obtain the Appsecret);

2. Access_token is the credential for users to authorize third-party applications to initiate interface calls (equivalent to (in user login state), stored on the client, user data may be leaked after maliciously obtaining access_token, user WeChat related interface functions may be maliciously initiated, etc.;

3. refresh_token is used to authorize third-party applications for users. Long-term credentials are only used to refresh access_token, but if leaked, it will be equivalent to access_token leakage, and the risk is the same as above.

It is recommended to put the secret and user data (such as access_token) on the App cloud server, and the cloud transfer interface calls the request.

After obtaining the access_token, make the interface call with the following prerequisites:

1. The access_token is valid and has not expired;

2. The WeChat user has authorized the corresponding interface scope (scope) of the third-party application account.

For interface scope (scope), the interfaces that can be called are as follows:

Among them, snsapi_base belongs to the basic interface. If the application already has other scope permissions, it will have the permissions of snsapi_base by default. Using snsapi_base can allow mobile web page authorization to bypass the action of jumping to the authorization login page to request user authorization, and directly jump to the third-party web page with the authorization temporary ticket (code), but this will make the user's authorized scope (scope) only snsapi_base , resulting in the inability to obtain data and basic functions that require user authorization.

F.A.Q

1. What is an authorization temporary ticket (code)?

Answer: A third party needs to use the code to obtain the access_token. The timeout of the code is 10 minutes. A code can only be successfully exchanged for the access_token once and then it will become invalid. The temporary and one-time nature of the code ensures the security of WeChat authorized login. Third parties can further enhance the security of their own authorized logins by using https and state parameters.

2. What is authorization scope?

Answer: Authorization scope (scope) represents the interface permissions authorized by users to third parties. Third-party applications need to apply to the WeChat open platform for permission to use the corresponding scope, and then use the method described in the document to allow users to authorize. After user authorization, the interface can be called only after obtaining the corresponding access_token.

3. What is the role of the style field in the WeChat login JS code embedded in the website?

Answer: The color style of the third-party page may be light or dark. If the third-party page has a light background, the style field should provide a "black" value (or not, black is the default value), then The corresponding WeChat login text style is black. The related effects are as follows:

If the "white" value is provided, the corresponding text description will be displayed in white, suitable for dark backgrounds. The relevant effects are as follows:

4. What is the role of the href field in the WeChat login JS code with a QR code embedded in the website?

Answer: If a third party feels that the default style provided by the WeChat team does not match its own page style, it can provide its own style file to override the default style. For example, if a third party feels that the default QR code is too large, it can provide relevant css style files and fill in the link address into the href field

.impowerBox .qrcode {width:200px;}<br/>.impowerBox .title {display: none;}<br/>.impowerBox .info {width: 200px;}<br/>.status_icon {display：none}<br/> .impowerBox .status {text-align: center;}

The relevant effects are as follows:

Get user personal information (UnionID mechanism)

Interface Description

This interface is used to obtain user personal information. Developers can obtain basic user information through OpenID. It is particularly important to note that if a developer has multiple mobile applications, website applications and public accounts, the user can be uniquely distinguished by obtaining the unionid in the user’s basic information, because as long as they are mobile applications under the same WeChat open platform account , website applications and public accounts, the user's unionid is unique. In other words, for the same user, the unionid is the same for different applications under the same WeChat open platform.

Request description

http request method: GET

https://api.weixin.qq.com/sns/userinfo?access_token=ACCESS_TOKEN&openid=OPENID

Parameter Description

Return instructions

Correct Json return result:

{ &lt;br/&gt;"openid":"OPENID",<br/>"nickname":"NICKNAME",<br/>"sex":1,<br/>"province":"PROVINCE",<br/>"city":"CITY",<br/>"country":"COUNTRY",<br/>"headimgurl":"http ://wx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/0",<br/>"privilege":[<br/>"PRIVILEGE1", &lt;br/&gt;"PRIVILEGE2"<br/>],<br/>"unionid": " o6_bmasdasdsad6_2sgVt7hMZOPfL"<br/><br/>}

"errcode":40003,"errmsg":"invalid openid "}<br/><br/>Call frequency limit

##10,000/ Minutes
##50,000/minute	Get basic user information
	代码示例： 第三方发起微信授权登录请求，微信用户允许授权第三方应用后，微信会拉起应用或重定向到第三方网站，并且带上授权临时票据code参数； 通过code参数加上AppID和AppSecret等，通过API换取access_token； 通过access_token进行接口调用，获取用户基本数据资源或帮助用户实现基本操作。 Login.php如下： 1   Copy after login 1 返回  code state*/ Copy after login 1 $appid = &#39;wxea1xxxxxxxx20cb62&#39;; Copy after login 1 $url = "https://open.weixin.qq.com/connect/qrconnect?appid=$appid&redirect_uri=http://zhiliaoke.com.cn/weixin.php&response_type=code&scope=snsapi_login&state=1&connect_redirect=1#wechat_redirect"; Copy after login header('location:'.$url); 验证处理如下： 1 <?php Copy after login 1 $code = $_GET[&#39;code&#39;]; Copy after login 1 $state = $_GET[&#39;state&#39;];//换成自己的接口信息 Copy after login 1 $appid = &#39;XXXXX&#39;; Copy after login 1 $appsecret = &#39;XXXXX&#39;; Copy after login 1 if (empty($code)) $this->error(&#39;授权失败&#39;); Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 $token_url = &#39;https://api.weixin.qq.com/sns/oauth2/access_token?appid=&#39;.$appid.&#39;&secret=&#39;.$appsecret.&#39;&code=&#39;.$code.&#39;&grant_type=authorization_code&#39;; Copy after login 1 $token = json_decode(file_get_contents($token_url)); Copy after login 1 if (isset($token->errcode)) { Copy after login 1 echo &#39;<h1>错误：</h1>&#39;.$token->errcode; Copy after login 1 echo &#39;<br/><h2>错误信息：</h2>&#39;.$token->errmsg; Copy after login 1 exit; Copy after login Copy after login Copy after login 1 } Copy after login Copy after login Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 $access_token_url = &#39;https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=&#39;.$appid.&#39;&grant_type=refresh_token&refresh_token=&#39;.$token->refresh_token;//转成对象 Copy after login 1 $access_token = json_decode(file_get_contents($access_token_url)); Copy after login 1 if (isset($access_token->errcode)) { Copy after login 1 echo &#39;<h1>错误：</h1>&#39;.$access_token->errcode; Copy after login 1 echo &#39;<br/><h2>错误信息：</h2>&#39;.$access_token->errmsg; Copy after login 1 exit; Copy after login Copy after login Copy after login 1 } Copy after login Copy after login Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 $user_info_url = &#39;https://api.weixin.qq.com/sns/userinfo?access_token=&#39;.$access_token->access_token.&#39;&openid=&#39;.$access_token->openid.&#39;&lang=zh_CN&#39;;//转成对象 Copy after login 1 $user_info = json_decode(file_get_contents($user_info_url)); Copy after login 1 if (isset($user_info->errcode)) { Copy after login 1 echo &#39;<h1>错误：</h1>&#39;.$user_info->errcode; Copy after login 1 echo &#39;<br/><h2>错误信息：</h2>&#39;.$user_info->errmsg; Copy after login 1 exit; Copy after login Copy after login Copy after login 1 } Copy after login Copy after login Copy after login 1 $rs =  json_decode(json_encode($user_info),true);//返回的json数组转换成array数组 Copy after login 1 //打印用户信息echo &#39;<pre class="brush:php;toolbar:false">&#39;; Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 print_r($rs);echo &#39; '; Copy after login 1 <br/> Copy after login Copy after login Copy after login Copy after login Copy after login Copy after login 1 ?> Copy after login   微信第三方登录（静默授权和非静默授权） 用户在微信客户端中访问第三方网页，公众号可以通过微信网页授权机制，来获取用户基本信息，进而实现业务逻辑。 微信的授权登录在日常应用中应用的非常广泛，越来越多的平台支持用户使用微信进行授权第三方登录  使用微信授权登录有哪些优势/好处；  1、用户量足够大，基本所有用户都会有微信，登录起来比较方便快捷；  2、微信作为一个开放平台，为众多公众号/服务开放了许多服务接口，让公众号能够为自己的用户提供更加个性、更加优质的产品服务； open id 和 union id ，这两个id有什么区别； 1、openid：在关注者与公众号产生消息交互后，公众号可获得关注者的openid，同一个用户，在不同公众号或移动应用下对应有不同open id标识； 2、union id：同一个用户，在不同公众号或移动应用下unionID相同；前提是，如若需要做多个公众号以及移动应用账户互通，得到唯一身份标识union id，则需要将多个公众号或移动应用在微信开放平台进行绑定，然后我们才能给拿到unionid； 所以，如果某个应用或者服务，有联合登录甚至多个公众应用多账户互通，可以采用union id来进行账户体系的用户识别与合并；即微信平台可以通过union id 来进行基于多个公众号之间的账户体系互通与识别合并；  微信联合登录是怎么登录的，有几种登录方式；微信联合登录和微信授权登录【授权登录（非静默授权）与静默授权】 微信联合登录；也就是我们常用的微信移动端/PC端之间的扫码登录，PC端用微信扫码登录，微信移动端确认授权登录后，应用可以从微信拿到用户的open id或union id，将微信获取的用户信息与自己账户体系中的用户身份进行关联； 授权登录：需要用户确认登录，这样可以通过用户的个人确认，获取用户全面的信息，无论是否关注相关微信公众号等都可以获取。 静默授权不需要用户确认，只需要用户访问某个网页，属于嵌套在普通网页里的授权形式，但是只能获取到用户的唯一标示openid和union id，无法拿到用户的微信头像、微信名称等个人信息，对于用户的简单认证还是很有用的。 如何通过微信账户体系来做多应用、多平台之间的账户互通体系；如果某个服务同时分布在多个公众号中，账户体系如何建立；如何做到用户身份唯一识别； 1）、同一用户不同公众号/应用下open id不同，同一用户不同公众号/应用下unionid相同； 2）、建立应用账户体系时，通过union来进行多应用/平台之间的用户账户体系识别与合并； 3）、多应用/平台建立账户体系时，需要做到唯一user id对应唯一union id； For a certain service, including mobile app, PC web page, and public account service, what is the data flow process for users to log in with WeChat authorization? 1. The user authorizes the mobile app service through WeChat; the application service can obtain the user's union id through the interface. At this time, if the id is not found in the database, it will be identified as a new user and a user will be created directly. id, the unique user id corresponds to the union id; 2. The user scans the WeChat QR code on the PC side to authorize joint login to obtain the PC side service; the application service can obtain the user's union id through the interface. At this time, If this ID is found in the database, the PC login account will be merged into the unique user ID account created before; 3. The user can log in to the public account service with WeChat authorization by following the public account of the service. ;The application server can obtain the user's union id through the interface. At this time, if the id is found in the database, the account logged in from the official account will be merged into the unique user id account created before; Explanation of the difference between the two scopes of web page authorization: 1. Authorization login The web page authorization initiated with snsapi_base as the scope is used to obtain the entry page The user's openid is authorized silently and automatically jumps to the callback page. What the user perceives is that he directly enters the callback page (often a business page). Features: The user is unaware; 2. Silent authorization. Web page authorization initiated with snsapi_userinfo as the scope is used to obtain the user's basic information. However, this kind of authorization requires the user to manually agree, and since the user has agreed, there is no need to pay attention, and the user's basic information can be obtained after authorization. Silent authorization in special scenarios: For users who have followed the official account, if the user enters from the official account’s session or custom menu The web authorization page of this official account, even if the scope is snsapi_userinfo, is silently authorized and the user is not aware of it. Web page authorization process: 1, guide the user to enter the authorization page to agree to the authorization, Obtain code Ensure that the WeChat public account has the permissions of the authorization scope (scope parameter) and guide the user to the authorization page Reference link : scope is snsapi_base Note: appid, redirect_uri, state must be negotiated with the backend https://open.weixin.qq.com/connect/oauth2 /authorize?appid=" wx_appid "&redirect_uri=" api.wx_reg "&response_type=code&scope=snsapi_login,snsapi_userinfo&state=1,0#wechat_redirect scope is snsapi_userinfo https://open.weixin.qq.com/connect/oauth2/authorize?appid=" wx_appid "&redirect_uri=" api.wx_reg "&response_type=code&scope=snsapi_base,snsapi_userinfo&state=1,0#wechat_redirect After the user agrees to the authorization If the user agrees to the authorization, the page will jump to redirect_uri/?code=CODE&state=STATE. 2, exchange code for web page authorization access_token (backend operation) redirect_uri on the url where the page jumps back. /?code=CODE&state=STATE. code The code is exchanged for the webpage authorization access_token. If the scope of the webpage authorization is snsapi_base, in this step, while obtaining the webpage authorization access_token, the openid is also obtained, and the snsapi_base-style webpage authorization process is completed. So far. 3: Personal information is required. The background gets the value through the code and returns it to the front end for operation Related recommendations: php implements WeChat template message push The above is the detailed content of PHP implements WeChat web page login authorization development. For more information, please follow other related articles on the PHP Chinese website! Statement of this Website The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn Hot AI Tools Undresser.AI Undress AI-powered app for creating realistic nude photos AI Clothes Remover Online AI tool for removing clothes from photos. Undress AI Tool Undress images for free Clothoff.io AI clothes remover Video Face Swap Swap faces in any video effortlessly with our completely free AI face swap tool! Show More Hot Article How to fix KB5055523 fails to install in Windows 11? 4 weeks ago By DDD How to fix KB5055518 fails to install in Windows 10? 4 weeks ago By DDD Roblox: Grow A Garden - Complete Mutation Guide 3 weeks ago By DDD Roblox: Bubble Gum Simulator Infinity - How To Get And Use Royal Keys 3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌 How to fix KB5055612 fails to install in Windows 10? 3 weeks ago By DDD Show More Hot Tools Notepad++7.3.1 Easy-to-use and free code editor SublimeText3 Chinese version Chinese version, very easy to use Zend Studio 13.0.1 Powerful PHP integrated development environment Dreamweaver CS6 Visual web development tools SublimeText3 Mac version God-level code editing software (SublimeText3) Show More Hot Topics Java Tutorial 1664 14 CakePHP Tutorial 1422 52 Laravel Tutorial 1316 25 PHP Tutorial 1267 29 C# Tutorial 1239 24 Show More Related knowledge Explain JSON Web Tokens (JWT) and their use case in PHP APIs. Apr 05, 2025 am 12:04 AM JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably, Explain late static binding in PHP (static::). Apr 03, 2025 am 12:04 AM Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead. PHP Program to Count Vowels in a String Feb 07, 2025 pm 12:12 PM A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase. What is a vowel? Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase: a, e, i, o, u Example 1 Input: String = "Tutorialspoint" Output: 6 explain The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases? Apr 03, 2025 am 12:03 AM What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency. PHP and Python: Comparing Two Popular Programming Languages Apr 14, 2025 am 12:13 AM PHP and Python each have their own advantages, and choose according to project requirements. 1.PHP is suitable for web development, especially for rapid development and maintenance of websites. 2. Python is suitable for data science, machine learning and artificial intelligence, with concise syntax and suitable for beginners. PHP in Action: Real-World Examples and Applications Apr 14, 2025 am 12:19 AM PHP is widely used in e-commerce, content management systems and API development. 1) E-commerce: used for shopping cart function and payment processing. 2) Content management system: used for dynamic content generation and user management. 3) API development: used for RESTful API development and API security. Through performance optimization and best practices, the efficiency and maintainability of PHP applications are improved. PHP: A Key Language for Web Development Apr 13, 2025 am 12:08 AM PHP is a scripting language widely used on the server side, especially suitable for web development. 1.PHP can embed HTML, process HTTP requests and responses, and supports a variety of databases. 2.PHP is used to generate dynamic web content, process form data, access databases, etc., with strong community support and open source resources. 3. PHP is an interpreted language, and the execution process includes lexical analysis, grammatical analysis, compilation and execution. 4.PHP can be combined with MySQL for advanced applications such as user registration systems. 5. When debugging PHP, you can use functions such as error_reporting() and var_dump(). 6. Optimize PHP code to use caching mechanisms, optimize database queries and use built-in functions. 7 The Enduring Relevance of PHP: Is It Still Alive? Apr 14, 2025 am 12:12 AM PHP is still dynamic and still occupies an important position in the field of modern programming. 1) PHP's simplicity and powerful community support make it widely used in web development; 2) Its flexibility and stability make it outstanding in handling web forms, database operations and file processing; 3) PHP is constantly evolving and optimizing, suitable for beginners and experienced developers. See all articles