kernel/private/rest/classes/oauth/utility.php
public static function getToken( ezcMvcRequest $request )
    {
        // 1. Should first extract required token from the request object
        //    as we know that the request parser does not support this at the
        //    moment we, will skip to the fallback right away. That is to say,
        //    ideally the request parser would make this header available to us,
        //    when available, automatically.

        $token = null;
        $checkStack = array( 'header', 'get', 'post' );

        foreach ( $checkStack as $step )
        {
            switch ( $step )
            {
                case 'header':
                    $token = self::getTokenFromAuthorizationHeader();
                break;

                case 'get':
                    $token = self::getTokenFromQueryComponent( $request );
                break;

                case 'post':
                    $token = self::getTokenFromHttpBody( $request );
                break;
            }

            if ( isset( $token ) ) // Go out of the loop if we find the token during the iteration
            {
                break;
            }
        }

        return $token;
    }
public static function getToken( ezcMvcRequest $request )
    {
        // 1. Should first extract required token from the request object
        //    as we know that the request parser does not support this at the
        //    moment we, will skip to the fallback right away. That is to say,
        //    ideally the request parser would make this header available to us,
        //    when available, automatically.

        $token = null;
        $checkStack = array( 'header', 'get', 'post' );

        foreach ( $checkStack as $step )
        {
            switch ( $step )
            {
                case 'header':
                    $token = self::getTokenFromAuthorizationHeader();
                break;

                case 'get':
                    $token = self::getTokenFromQueryComponent( $request );
                break;

                case 'post':
                    $token = self::getTokenFromHttpBody( $request );
                break;
            }

            if ( isset( $token ) ) // Go out of the loop if we find the token during the iteration
            {
                break;
            }
        }

        return $token;
    }
public static function getToken ( ezcMvcRequest $ request ) { // 1. Should first extract required token from the request object //    as we know that the request parser does not support this at the //    moment we, will skip to the fallback right away. That is to say, //    ideally the request parser would make this header available to us, //    when available, automatically. $ token = null ; $ checkStack = array ( 'header' , 'get' , 'post' ) ; foreach ( $ checkStack as $ step ) { switch ( $ step ) { case 'header' : $ token = self :: getTokenFromAuthorizationHeader ( ) ; break ; case 'get' : $ token = self :: getTokenFromQueryComponent ( $ request ) ; break ; case 'post' : $ token = self :: getTokenFromHttpBody ( $ request ) ; break ; } if ( isset ( $ token ) ) // Go out of the loop if we find the token during the iteration { break ; } } return $ token ; }
Retrieving token as per section 5 of draft-ietf-oauth-v2-10

Token can be present inside the Authorize header, inside a URI query
parameter, or in the HTTP body.

According to section 5.1 the header is the preferred way, and the query
component and HTTP body are only looked at if no such header can be found.

@TODO A configuration mechanism should alternatively let us select which
method to use: 1. header, 2. query component, 3. http body, in other words
to override the default behaviour according to spec.

@param string $ezcMvcRequest
@return void
Retrieving token as per section 5 of draft - ietf - oauth - v2 - 10