本文共 4905 字，大约阅读时间需要 16 分钟。

OAuth 2 ??????

OAuth 2 ????????????????????????????????????????????????????????????? OAuth 2 ???????????????????????????????????

OAuth 2 ??

OAuth 2 ????????????

??????Resource Owner?

?????? OAuth 2 ??????????????????????? OAuth 2 ????????????????

??????Resource Server?

??????????????????????

??????Authorization Server?

??????????????????????????????Access Token?????????

????Client?

???????????????????????????????????

??????Resource Owner?

?????? OAuth 2 ??????????????????????/???????????????????????? OAuth 2 ?????????????????????????????????????????Scope?????

?????????????????????????

??????Authorization Server????????Resource Server?

? OAuth 2 ????????????????????????????????????????????????????????????

??????????????????????????????GitHub ???????????????????????????????????????????????

????Client?

???? OAuth 2 ??????????????????????????????????????????????????????????????

????????????????????????????????????

OAuth 2 ?????

????? OAuth 2 ????????

Authorization Request

???????????????????????????

• response_type: ????????? code??? Authorization Code Flow?? token??? Implicit Flow??
• client_id: ????????
• redirect_uri: ??????????????????????????
• scope: ?????????????
• state: ???? CSRF ?????????

Authorization Grant

????????????????????????????? redirect_uri???? code ? state ???

Access Token Request

??????????? code ???????????????

• grant_type: ????????? authorization_code??? Authorization Code Flow??
• code: ????????????
• redirect_uri: ??????????
• client_id: ???????
• client_secret: ??????

Access Token

??????????????????????????????access_token?????????????????token_type????????expires_in???

???????

??? OAuth 2 ?????????????????????????????

• ????
• ????
• ??? URI?Redirect URI?

??? URI ??????????????????????????????????????????????????????

??? ID ??????

???????????????????????? ID ???????client_secret????? ID ?????????????????? URL?????????????????????????

?????Authorization Grant?

OAuth 2 ??????????????????????????????? Grant Type ??????????????

??????

Authorization Code Flow

???????????????????????

Implicit Flow

?????????? Web ????????????????????

Resource Owner Password Credentials Flow

??????????????????????????????

Client Credentials Flow

????????????????????????

????????

Authorization Code Flow

????

??????? URL ??????????

https://authorization-server.com/auth?response_type=code&client_id=29352915982374239857&redirect_uri=https%3A%2F%2Fexample-client.com%2Fcallback&scope=create+delete&state=xcoiv98y2kd22vusuye3kch

????

????????????????????????????????????????????????????? redirect_uri???? code ? state?

??????

??????????? code ????????

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&code=g0ZGZmNjVmOWIjNTk2NTk4ZTYyZGI3&redirect_uri=https%3A%2F%2Fexample-client.com%2Fcallback&client_id=29352915982374239857&client_secret=your_client_secret

??????

?????????????????? access_token ????

{
  "access_token": "MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "IwOGYzYTlmM2YxOTQ5MGE3YmNmMDFkNTVk",
  "scope": "create delete"
}

Implicit Flow

????

??????? URL?

https://{yourOktaDomain}.com/oauth2/default/v1/authorize?client_id=0oabv6kx4qq6h1U5l0h7&response_type=token&redirect_uri=http%3A%2F%2Flocalhost%3A8080&state=state-296bc9a0-a2a2-4a57-be1a-d0e2fd9bb601&nonce=foo

????

????????????????????????????????????????????????????? redirect_uri???? access_token?token_type ????

??????

????? access_token ???????

Resource Owner Password Credentials Flow

??????

???????????????

????

??????????????????

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
grant_type=password&username=johndoe&A3ddj3w

??????

???????????????? access_token ????

{
  "access_token": "2YotnFZFEjr1zCsicMWpAA",
  "token_type": "example",
  "expires_in": 3600,
  "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA",
  "example_parameter": "example_value"
}

Client Credentials Flow

???????

?????????????????

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials

??????

???????????????? access_token ????

{
  "access_token": "2YotnFZFEjr1zCsicMWpAA",
  "token_type": "example",
  "expires_in": 3600,
  "example_parameter": "example_value"
}

??

OAuth 2 ???????????????????????????????????????????????????????????????????????????? OAuth 2 ?????? Google?Azure?OAuth2Alliance ??????????????????????? OAuth 2 ????

???????

OAuth 2 ????

OAuth 2 ??????

????? OAuth 2?

?OAuth 2 ? JWT ?????

???????

??	??
Authorization Grant	????
Authorization Code	???
Access Token	????
Authorization	??
Authentication	??
Client Credentials Flow	???????
Implicit Flow	????
Resource Owner Password Credentials Flow	???????????
Client ID	??? ID
Client Secret	?????