OAuth2.0令牌奇怪的行为（无效凭证401） [英] OAuth2.0 token strange behaviour (Invalid Credentials 401)
问题描述
- 用户使用选定范围确认访问Google帐户的权限。
- 检索刷新令牌并保存为长时间存储。
- 每次需要（如果访问令牌已过期）访问令牌都会被检索并用于访问API。
但有时（至今只有两次超过6个月）我遇到过奇怪的行为：
请求Google API返回无效凭证（401）错误。
刷新访问令牌（使用存储的刷新令牌）并没有帮助。
以下是测试此问题时得到的一些结构化输出： p>
+ ----------------------------- -------------------------------------------- +
| 1.使用令牌刷新。 |
| 2.刷新代币。 |
+ --------------------------------------------- ---------------------------- +
|访问：************************************************ **** |
|刷新：********************************************* |
|到期时间：3600 |
|创建于：2013-07-23 13:12:36 |
+ --------------------------------------------- ---------------------------- +
我还尝试通过向
发送请求来验证新鲜访问令牌。 https：// www。 googleapis.com/oauth2/v1/tokeninfo
+ -------------- -------------------------------------------------- --------- +
| 1.尝试检查代币。 |
| 2.完成检查令牌。 |
+ --------------------------------------------- ---------------------------- +
| issued_to：************。apps.googleusercontent.com |
|受众群体：************。apps.googleusercontent.com |
| user_id：************ |
| expires_in：3600 |
|电子邮件：**********@gmail.com |
| verified_email：1 |
| access_type：offline |
|范围:: |
+ --------------------------------------------- ---------------------------- +
| https://www.googleapis.com/auth/userinfo.email |
| https://www.googleapis.com/auth/userinfo.profile |
| https://www.googleapis.com/auth/plus.me |
| https://www.googleapis.com/auth/drive |
+ --------------------------------------------- ---------------------------- +
但是当我尝试访问驱动器提要时，响应是：
错误调用GET https://www.googleapis.com/drive/ v2 / files（401）无效凭证
域：全局
原因：authError
消息：无效凭证
位置类型：标题
位置：授权
我们也遇到了与日历相同的问题。
So：
- 令牌在之前（一切正常）有效。
- 刷新令牌仍然有效。
- 所有其他代币仍然工作得很好，这意味着代码是有效。
- 所有其他代币仍然工作得很好，这意味着代码是有效。
正常情况下，当标记被撤销时，尝试刷新标记时会返回invalid_grant错误。
问题
- 这种行为的原因是什么？如果刷新令牌被撤销或以其他方式失效，请求新访问令牌是否会产生错误？ b $ b
错误代码：
https：/ /developers.google.com/drive/handle-errors#401_invalid_credentials
401：凭证无效
授权标头无效。您使用的访问令牌已过期或无效。
错误：{
错误：[
{
domain：global，
reason：authError，
message：无效凭证，
locationType：header，
location：Authorization，
}
]，
代码：401，
消息：无效凭证
}
}
这完全符合您的错误版本，所以很可能是Google认为您的请求有问题。
但是，正如您所知，Google API请求可能会返回明显无助于实际诊断问题的错误。由于多种原因，我收到了无效凭证错误。这几乎总是因为我做了某种我认为无关紧要的改变，但确实如此。
我的第一个想法（在这里黑暗中拍摄）会请前往Google API控制台：
https ：//code.google.com/apis/console
Google认证令牌验证程序（ https://www.googleapis.com/oauth2/v1/tokeninfo ）可以返回有效的回复，但可能客户端密钥或客户端ID已经改变。
即使响应正文中的微小变化也会导致此错误。
我不知道您是如何通过REST调用或客户端库发出请求的，但是我使用允许命令行接口进行API调用的ruby库。我发现这个& OAuth2 Playground在诊断Google API调用中非常有用。
仅供参考：Google API只收到2个错误：无效凭证和权限不足 。后者几乎总是与坏的范围有关。前者只是其他的一切。
我也会说，如果你在6个月内只遇到2个错误，你很幸运！
Usually, Google OAuth2.0 mechanism is working great.
- The user confirms permission to access Google account with selected scopes.
- The refresh token is retrieved and saved to long time storage.
- Each time needed (if the access token expired) access token is retrieved and used to access APIs.
But sometimes (thus far only two times for more than 6 months) I've experienced strange behaviour:
Requests to Google APIs return Invalid Credentials (401) error. Refreshing the access token (using the stored refresh token) does not help.
Here is some structured output I've got when testing this issue:
+ ------------------------------------------------------------------------- +
| 1.TRYING TO REFRESH THE TOKEN. |
| 2.DONE REFRESHING THE TOKEN. |
+ ------------------------------------------------------------------------- +
| access: **************************************************** |
| refresh: ********************************************* |
| expires: 3600 |
| created: 2013-07-23 13:12:36 |
+ ------------------------------------------------------------------------- +
I've also tried to verify the "fresh" access token by sending requests to https://www.googleapis.com/oauth2/v1/tokeninfo
+ ------------------------------------------------------------------------- +
| 1. TRYING TO CHECK THE TOKEN . |
| 2. DONE CHECKING THE TOKEN THE TOKEN. |
+ ------------------------------------------------------------------------- +
| issued_to: ************.apps.googleusercontent.com |
| audience: ************.apps.googleusercontent.com |
| user_id: ************ |
| expires_in: 3600 |
| email: **********@gmail.com |
| verified_email: 1 |
| access_type: offline |
| scopes:: |
+ ------------------------------------------------------------------------- +
| https://www.googleapis.com/auth/userinfo.email |
| https://www.googleapis.com/auth/userinfo.profile |
| https://www.googleapis.com/auth/plus.me |
| https://www.googleapis.com/auth/drive |
+ ------------------------------------------------------------------------- +
But when I try to access drive feed the response is:
Error calling GET https://www.googleapis.com/drive/v2/files (401) Invalid Credentials
domain: global
reason: authError
message: Invalid Credentials
locationType: header
location: Authorization
We also experienced the same issue with calendars. So:
- Token was valid before (everything worked).
- Refreshing token still works.
- Requesting a feed responds with "Invalid Credentials" error.
- All the other tokens are still working great, meaning that the code is valid.
Normally when the token is revoked "invalid_grant" error is returned when trying to refresh the token.
Questions
- What can be the reason for this behaviour? If the refresh token was revoked or got invalid in some other way, should the request for new access token produce error?
- Is there a way to validate the refresh token?
Per the Google API docs on errors & error codes:
https://developers.google.com/drive/handle-errors#401_invalid_credentials
401: Invalid Credentials
Invalid authorization header. The access token you're using is either expired or invalid.
error: {
errors: [
{
"domain": "global",
"reason": "authError",
"message": "Invalid Credentials",
"locationType": "header",
"location": "Authorization",
}
],
"code": 401,
"message": "Invalid Credentials"
}
}
This matches your version of the error exactly, and so is very probably what Google thinks is wrong with your request.
But, as you well know, Google API requests can return errors that are distinctly unhelpful to actually diagnosing the problem. I have gotten "Invalid Credentials" errors for a number of reasons. It is almost always really because I have made some sort of change that I thought would not matter, but really does.
My first thought (shot in the dark here) would be to go to the Google API console:
https://code.google.com/apis/console
Googles auth token verifier ( https://www.googleapis.com/oauth2/v1/tokeninfo ) can return a valid response, but maybe the client secret or client id will have been changed.
Even tiny changes in the response body can also cause this error.
I don't know how you are making requests, whether by REST calls or a client lib, but I use the ruby lib which allows a command line interface to making API calls. I have found this & the OAuth2 Playground very helpful in diagnosing Google API calls.
Just an FYI: I have only gotten 2 errors from the Google API: "Invalid Credentials" and "Insufficient Permissions". The latter has almost always had to do with bad scopes. The former is just about everything else.
I would also say that if you have only experienced 2 errors in 6 months, you are lucky!
这篇关于OAuth2.0令牌奇怪的行为（无效凭证401）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
