RFC6749 Oauth2.0 阅读笔记

为啥要写这篇

最近有facebook好友的接入工作，重读了一遍oauth2.0。相较第一次读，对四种授权模式，主要是Authorization Code, Implicit Grant有了正确的理解。所以有了这篇。

1. 为什么需要Oauth2

https://tools.ietf.org/html/r...

OAuth addresses these issues by introducing an authorization layer
   and separating the role of the client from that of the resource
   owner.  In OAuth, the client requests access to resources controlled
   by the resource owner and hosted by the resource server, and is
   issued a different set of credentials than those of the resource
   owner.

关键是，OAuth 引入了一个授权层，用来分离两种不同的角色：客户端和资源所有者。从而资源所有者（用户）的credentials，主要是密码，不会暴露给客户端。

2. four roles

https://tools.ietf.org/html/r...

resource owner

An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user.

资源拥有者， 如豆瓣用户，假设认证服务器是微信。

resource server

The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens.

用户访问的网站，如豆瓣。

client

An application making protected resource requests on behalf of the resource owner and with its authorization. The term "client" does not imply any particular implementation characteristics (e.g., whether the application executes on a server, a desktop, or other devices).

客户端，是一个程序，代表资源拥有者的用其授权发起资源访问，可以在桌面上的浏览器，手机端的app，服务器上运行。

authorization server

The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

在认证，授权成功后，发放访问token至客户端， 如微信发放访问token至豆瓣。

3. client

todo 结合facebook开发者文档，结合具体参数，分析为什么要这么做。

4. four grant types

https://tools.ietf.org/html/r...

四种获得授权的方式，即client如何拿到access token.

An authorization grant is a credential representing the resource
   owner's authorization (to access its protected resources) used by the
   client to obtain an access token. This specification defines four
   grant types -- authorization code, implicit, resource owner password
   credentials, and client credentials -- as well as an extensibility
   mechanism for defining additional types.

Authorization Code

https://tools.ietf.org/html/r...

关键在于authorization code只可使用一次，假设resource owner到client的链接为http，可能被窃听。

因为到authorization server的链接是https, access_token绝不会被暴露，而授权码就算被暴露，也会因用户的充登，而让此前中间人获取的access_token失效。

Implicit Grant

https://tools.ietf.org/html/r...

相较Authorization Code，authorization server直接返回access token， 关键点在于access token在callback中，以fragment方式返回access token，这样，user-agent访问Web-Hosted Client Resource时，不会带上access token，access token留在本地，注意这种情况下client也在本地。

Resource Owner Password Credentials Grant

https://tools.ietf.org/html/r...

用户相当信任client，直接给密码client，client用密码获得access token.

Client Credentials Grant

https://tools.ietf.org/html/r...

authorization server完全相信client，client通过证书直接拿access token

参考