OAuth 2 中的承载令牌和令牌类型是什么? [英] What are Bearer Tokens and token_type in OAuth 2?

问题描述

我正在尝试实施 Resource Owner &密码凭据来自 OAuth 2 规范.我无法理解通过有效响应返回的 token_type 值.在规范中，所有示例都显示 "token_type":"example" 但说它应该是

I'm trying to implement the Resource Owner & Password Credentials flow from the OAuth 2 spec. I'm having trouble understanding the token_type value that gets sent back with a valid response. In the spec all the examples show "token_type":"example" but says it should be

token_type必需的.发行的令牌类型如中所述第 7.1 节.值不区分大小写.

token_type REQUIRED. The type of the token issued as described in Section 7.1. Value is case insensitive.

有人可以向我解释一下吗?

Can someone please explain this to me?

推荐答案

token_type 是 Access Token generate call to Authorization server 中的一个参数，本质上代表了一个 access_token 如何将生成并呈现给资源访问调用.您在访问令牌生成调用中向授权服务器提供 token_type.

token_type is a parameter in Access Token generate call to Authorization server, which essentially represents how an access_token will be generated and presented for resource access calls. You provide token_type in the access token generation call to an authorization server.

如果您选择 Bearer(大多数实现的默认设置)，则会生成一个 access_token 并发回给您.Bearer 可以简单地理解为授予对该令牌的持有者的访问权".一个有效的令牌，没有问题.另一方面，如果您选择 Mac 和 sign_type(在大多数实现中默认为 hmac-sha-1)，访问令牌被生成并作为一个属性保存在密钥管理器中，一个加密的秘密作为 发回access_token.

If you choose Bearer (default on most implementation), an access_token is generated and sent back to you. Bearer can be simply understood as "give access to the bearer of this token." One valid token and no question asked. On the other hand, if you choose Mac and sign_type (default hmac-sha-1 on most implementation), the access token is generated and kept as secret in Key Manager as an attribute, and an encrypted secret is sent back as access_token.

是的，您可以使用自己的 token_type 实现，但这可能没有多大意义，因为开发人员需要遵循您的流程，而不是 OAuth 的标准实现.

Yes, you can use your own implementation of token_type, but that might not make much sense as developers will need to follow your process rather than standard implementations of OAuth.

这篇关于OAuth 2 中的承载令牌和令牌类型是什么?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！