' . htmlspecialchars($msg) . '
' . 'Back to start'; bb_foot(); exit; } // The user denied access, or BentBox returned an error. if (isset($_GET['error'])) { fail(($_GET['error']) . ' — ' . ($_GET['error_description'] ?? '')); } // CSRF: the returned state must match the one we set in the cookie. $state = $_GET['state'] ?? ''; $expected = $_COOKIE[BB_STATE_COOKIE] ?? ''; if (!$state || !$expected || !hash_equals($expected, $state)) { fail('Invalid OAuth state (CSRF check failed). Please start again.'); } setcookie(BB_STATE_COOKIE, '', bb_cookie_opts(time() - 3600)); // consume it // Exchange the code for tokens (server-side; the secret stays here). $code = $_GET['code'] ?? ''; if (!$code) fail('No authorization code was returned.'); $resp = bb_exchange_code($code); $tok = $resp['json'] ?? null; if ($resp['http'] < 200 || $resp['http'] >= 300 || empty($tok['access_token'])) { error_log('Token exchange failed (HTTP ' . $resp['http'] . '): ' . $resp['raw']); fail($tok['error_description'] ?? 'Token exchange failed.'); } // Store the connection (encrypted cookie). Nothing sensitive is placed in a URL. bb_store_connection($tok); // Confirmation page (educational — shows what the exchange returned, minus secrets). bb_head('Connected', 'The authorization code was exchanged for an access token.'); ?>Your server now holds an access token for this BentBox account. Here's what came back (tokens hidden):