从passportjs中的刷新令牌获取oauth访问令牌 [英] Get an oauth access token from refresh token in passportjs

问题描述

要确定何时使用刷新令牌来请求新的访问令牌，我知道有两种方法（见下文）。无需修改 passport-google-oauth 图书馆，这两种方法都可行吗？

1）抢先方法

• 保存访问令牌的到期时间它被授予


• 每当使用访问令牌访问API时，根据当前时间检查到期时间。
  
• 如果访问令牌没有过期，请使用它访问API


• 如果访问令牌已过期（或接近过期），请提供刷新令牌以获取新的访问令牌

ul>



2）处理失败方法






• 始终提供访问令牌


• 如果访问令牌无法进行身份验证，请提供刷新令牌，并获取新的访问令牌
  / $>
  
  

  。请注意，Passport不会主动使用访问令牌或刷新令牌，除了获取用户以外个人资料登录。您在申请API时必须负责使用这些令牌。因此，您可以实现您描述的任一方法，Passport不参与该流程。

  
  
  

  另请参阅： https://github.com/jaredhanson/passport-google-oauth/issues/23

  
  

  To determine when to use a refresh token to ask for a new access token, I'm aware of two approaches (below). Are either of these approaches possible without modifying the passport-google-oauth library?

  1) The "pre-emptive" method

  • Save the access token's expiry time when its granted
  • Check the expiry time against the current time whenever using an access token to access the API
  • If the access token is not expired, use it to access the API
  • If the access token is expired (or close to being expired), supply the refresh token to get a new access token

  2) The "handle failure" method

  • Always supply access token
  • If the access token fails to authenticate, supply the refresh token, get a new access token

  Thanks. Also welcome any alternatives.

  解决方案

  Note that Passport does not actively use the access token or refresh token, other than to fetch the user profile during login. You're application is responsible for using these tokens when making whatever API requests are necessary. As such, you can implement either method you describe, Passport is not involved in the process.

  See also: https://github.com/jaredhanson/passport-google-oauth/issues/23

  这篇关于从passportjs中的刷新令牌获取oauth访问令牌的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！