Developer notes

Overview · Installation · Configuration · Usage · FAQ

Protocols

Provider	Flow	Identity source
Google	OpenID Connect, authorization code, PKCE (S256), nonce	ID token (RS256), sub, email_verified
Google One Tap	Google Identity Services google.accounts.id with nonce; the credential is an ID token	Same verification as Google
Apple	Authorization code, response_mode=form_post, scopes name email, nonce; client secret = ES256 JWT (kid Key ID, iss Team ID, aud https://appleid.apple.com, sub Services ID, 5-minute lifetime)	ID token (RS256), sub; the name comes only once in the user field of the first POST
Microsoft	Identity platform v2.0, OpenID Connect, PKCE, nonce, tenant common/consumers/organizations/ID	ID token; the issuer must be https://login.microsoftonline.com/{tid}/v2.0; the e-mail counts as confirmed only for personal accounts or with xms_edov
Facebook	OAuth 2 code flow (Graph API, configurable version), appsecret_proof on Graph calls	/me app-scoped id
Amazon	Login with Amazon, authorization code + PKCE, scope profile	/user/profile user_id
LinkedIn	Sign In with LinkedIn using OpenID Connect	/v2/userinfo over TLS with the access token
Discord	OAuth 2 code flow, scopes identify email	/users/@me id; e-mail confirmed only with verified
OpenID Connect	Discovery, authorization code, PKCE when advertised, nonce, client_secret_basic or _post	ID token (RS256 or ES256)

ID tokens are verified with the provider’s published keys (JWKS, cached 6 hours, one refresh on an unknown kid): only RS256/ES256 (never none or HMAC), iss, aud (and azp with several audiences), exp/iat/nbf with 5 minutes of clock tolerance, nonce, sub. The verifier and the ES256 signer use OpenSSL only; no third-party libraries are bundled.

Flow and security

1. kv_social_login_pro.start (GET, after a click) creates state (256 bit), nonce and the PKCE verifier, stores them in ?:kv_slp_states under the SHA-256 of the state (15 minutes, single use) and sets the browser binding cookie kv_slp_b (HttpOnly, SameSite=Lax, Secure on HTTPS) whose hash is stored with the state.
2. kv_social_login_pro.callback is the one redirect URI for all providers. Apple’s form_post is a cross-site POST without cookies: the POST only stores the code and the user field in the pending state and redirects to the same URI with GET, which carries the browser’s cookies.
3. The GET checks the state (pending, not expired), the binding cookie (protection against login CSRF and session fixation), marks the state used (an atomic status change), exchanges the code and verifies the result. The provider is taken from the state, never from the request.
4. The account is resolved (see Usage) and the customer is signed in with core fn_login_user($user_id, true) (new session ID, carts merged).
5. Vendor sign-in finishes in the vendor panel through a one-time hand-off token (60 seconds, bound to the same binding cookie): vendor.php?dispatch=auth.kv_slp_vendor&token=... (auth is a trusted controller). It checks fn_check_user_type_admin_area(), fn_check_user_type_access_rules() and the vendor’s status.

One Tap: the page only contains the public client ID. The script asks kv_social_login_pro.onetap_nonce (POST, never cached) for a nonce, which is also set in the HttpOnly cookie kv_slp_n with an expiry and an HMAC, then posts the credential to kv_social_login_pro.onetap. The token is accepted only with the signature, the audience and the nonce of that cookie (single use). Neither step needs a session.

Return URLs are limited to the store’s own hosts. Client secrets and the Apple key are stored with AES-256-CBC and HMAC-SHA256 (encrypt-then-MAC, keys derived from the store’s crypt key), masked in the admin panel and never logged. Storefront POSTs (connect, complete, unlink) require the CS-Cart security hash; callback and the One Tap endpoints are exempt by mode and protected as described.

Full page cache (4.21)

The buttons and the One Tap configuration depend only on settings, providers and the license, so the HTML is the same for every guest (controllers/frontend/init.post.php never touches the session). The add-on’s own dispatches are never cacheable. Cookies are set only by start and onetap_nonce. Nothing is written to ?:storage_data.

Data model

Table	Contents
?:kv_slp_providers	provider + company (0 = all storefronts): status, position, client ID, encrypted secret and key, params (JSON)
?:kv_slp_identities	user, provider, subject, company scope, e-mail and whether confirmed, name, avatar URL, created, last sign-in; unique provider + subject + company
?:kv_slp_accounts	accounts created through a provider and whether a password was set since
?:kv_slp_states	flow states, hand-off tokens (hashes only)
?:kv_slp_log	events: start, login, register, link, unlink, fail (+ reason, channel, area)
?:kv_slp_cache	provider keys and discovery documents

Hooks

PHP: post_delete_user (removes identities), update_profile (a password typed in the profile marks the account as having a password). Templates (storefront): index:login_buttons (.post), profiles:account_update (.post), index:scripts, index:styles; (admin): auth:login_form (.post, vendor panel only), profiles:detailed_content (.post), addons:tabs_content, addons:manage. Pre/post controllers: frontend init.post, profiles.post; backend auth.pre, profiles.pre, profiles.post, addons.post.

License check

Tygh\Addons\KvSocialLoginPro\License\Client (generated) verifies the license. Gate points: Config::isActive() in the storefront data (buttons, One Tap), start, One Tap and the connect links of the profile panels. Not gated: callback of a sign-in that already started, the follow-up steps, and disconnecting.

Not in 1.0.0

X (Twitter) and Telegram (available in the built-in Social login), storing provider access tokens for API use, avatars as profile images, social sign-in for administrators.

File map

Path	Purpose
app/addons/kv_social_login_pro/addon.xml	Settings, tables
init.php, func.php	Hooks, storefront data, fn_kv_social_login_pro_is_licensed()
Tygh/Addons/KvSocialLoginPro/Flow.php	Start, callback, account resolution, follow-up steps, One Tap, vendor hand-off
Providers/	One class per provider; OidcProvider (ID token verification), AbstractProvider
Jwt.php, Http.php, Util.php	JWT verification and ES256 signing, HTTP client, helpers
Store.php, Accounts.php, Panel.php, Stats.php, Importer.php, Icons.php, Config.php, ProviderRegistry.php	Data, accounts, profile panels, statistics, import, brand marks, settings, provider list
License/, controllers/backend/kv_social_login_pro_license.php	License check (generated)
Upgrade/Synchronizer.php	Self-healing upgrades (generated)
controllers/frontend/, controllers/backend/	Pages and endpoints
schemas/	Menu, permissions (admin and vendor), CSRF validation
var/themes_repository/responsive/templates/addons/kv_social_login_pro/	Buttons, profile panel, follow-up pages
js/addons/kv_social_login_pro/func.js	Button placement and One Tap (jQuery, Google’s library loaded only for One Tap)