// 配置参数 let activeId = "2197"; let awardId = 10266; let cOpenId = "aaaa"; letMAC = "001a9a000000"; let cUDID = "23320005"; let accessToken = "bbb"; let cChip = "ccc"; let cEmmcCID = "ddd"; let cModel = "eee";
// 签名 let signStr = `MAC=${MAC}&accessToken=${accessToken}&cChip=${cChip}&cEmmcCID=${cEmmcCID}&cModel=${cModel}&cOpenId=${cOpenId}&cUDID=${cUDID}&id=${activeId}&source=wechat`; var sign = CryptoJS.SHA256(signStr).toString();
resource owner An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user.
resource server The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens.
client An application making protected resource requests on behalf of the resource owner and with its authorization. The term "client" does not imply any particular implementation characteristics (e.g., whether the application executes on a server, a desktop, or other devices).
authorization server The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.
The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server as the resource server or a separate entity. A single authorization server may issue access tokens accepted by multiple resource servers.
The abstract OAuth 2.0 flow illustrated in Figure 1 describes the interaction between the four roles and includes the following steps:
(A) The client requests authorization from the resource owner. The authorization request can be made directly to the resource owner (as shown), or preferably indirectly via the authorization server as an intermediary. 用户打开客户端以后,客户端要求用户给予授权。 (B) The client receives an authorization grant, which is a credential representing the resource owner's authorization, expressed using one of four grant types defined in this specification or using an extension grant type. The authorization grant type depends on the method used by the client to request authorization and the types supported by the authorization server. 用户同意给予客户端授权。
(C) The client requests an access token by authenticating with the authorization server and presenting the authorization grant. 客户端使用上一步获得的授权,向认证服务器申请令牌。 (D) The authorization server authenticates the client and validates the authorization grant, and if valid, issues an access token. 认证服务器对客户端进行认证以后,确认无误,同意发放令牌
(E) The client requests the protected resource from the resource server and authenticates by presenting the access token. 客户端使用令牌,向资源服务器申请获取资源。 (F) The resource server validates the access token, and if valid, serves the request. 资源服务器确认令牌无误,同意向客户端开放资源。 https://datatracker.ietf.org/doc/html/rfc6749#section-1.2
Scope is a mechanism in OAuth 2.0 to limit an application’s access to a user’s account. An application can request one or more scopes, this information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted.
/** * {@code scope} 含义,以{@code description} 为准 */ USER_OPENID("openid", "Associate you with your personal info on Google", true), USER_EMAIL("email", "View your email address", true), USER_PROFILE("profile", "View your basic profile info", true), USER_PHONENUMBERS_READ("https://www.googleapis.com/auth/user.phonenumbers.read", "View your phone numbers", false), USER_ORGANIZATION_READ("https://www.googleapis.com/auth/user.organization.read", "See your education, work history and org info", false), USER_GENDER_READ("https://www.googleapis.com/auth/user.gender.read", "See your gender", false), USER_EMAILS_READ("https://www.googleapis.com/auth/user.emails.read", "View your email addresses", false),
USER_BIRTHDAY_READ("https://www.googleapis.com/auth/user.birthday.read", "View your complete date of birth", false) // ... }
USER_OPENID("openid", "Associate you with your personal info on Google", true), USER_EMAIL("email", "View your email address", true), USER_PROFILE("profile", "View your basic profile info", true),