OAuth2.0认证和授权原理
什么是OAuth授权？ 一、什么是OAuth协议 OAuth(开放授权)是一个开放标准。 允许第三方网站在用户授权的前提下访问在用户在服务商那里存储的各种信息。 而这种授权无需将用户提供用户名和密码提供给该第三方网站。 OAuth允许用户提供一个令牌给第三方网站，一
什么是OAuth授权？
一、什么是OAuth协议
OAuth(开放授权)是一个开放标准。
允许第三方网站在用户授权的前提下访问在用户在服务商那里存储的各种信息。
而这种授权无需将用户提供用户名和密码提供给该第三方网站。
OAuth允许用户提供一个令牌给第三方网站，一个令牌对应一个特定的第三方网站，同时该令牌只能在特定的时间内访问特定的资源。
二、OAuth的原理和授权流程
OAuth的认证和授权的过程中涉及的三方包括：
服务商：用户使用服务的提供方，一般用来存消息、储照片、视频、联系人、文件等(比如Twitter、Sina微波等)。
用 户：服务商的用户
第三方：通常是网站，该网站想要访问用户存储在服务商那里的信息。
比如某个提供照片打印服务的网站，用户想在那里打印自己存在服务商那里的网络相册。
在认证过程之前，第三方需要先向服务商申请第三方服务的唯一标识。
OAuth认证和授权的过程如下:
1、用户访问第三方网站网站，想对用户存放在服务商的某些资源进行操作。
2、第三方网站向服务商请求一个临时令牌。
3、服务商验证第三方网站的身份后，授予一个临时令牌。
4、第三方网站获得临时令牌后，将用户导向至服务商的授权页面请求用户授权，然后这个过程中将临时令牌和第三方网站的返回地址发送给服务商。
5、用户在服务商的授权页面上输入自己的用户名和密码，授权第三方网站访问所相应的资源。
6、授权成功后，服务商将用户导向第三方网站的返回地址。
7、第三方网站根据临时令牌从服务商那里获取访问令牌。
8、服务商根据令牌和用户的授权情况授予第三方网站访问令牌。
9、第三方网站使用获取到的访问令牌访问存放在服务商的对应的用户资源。
三、目前支持OAuth的网站有哪些？
t.sina.com.cn
t.qq.com
t.sohu.com
t.163.com
www.douban.com
www.twitter.com
www.facebook.com
Google Buzz
文件来源于：
http://www.6zou.net/tech/what_is_oauth.html
所谓OAuth（即Open Authorization，开放授权），它是为用户资源授权提供了一种安全简单的标准，也就是说用户在访问第三方web或应用的时候，第三方不会知道用户的信息（登录密码等），现在基本都支持OAuth2.0版本了。
首先来看看我们在第三方使用oauth流程如下：
第一步：用户登录第三方网站，使用qq登录。
第二步：点击登录后，会跳到qq平台提示输入用户名和密码。
第三步：如果用户名和密码正确，会提示是否接受授权，如果授权成功，第三方网站就能访问你的资源了，qq头像、用户名等
认证和授权过程（包括三方）
1、服务提供方，用户使用服务提供方来存储受保护的资源，如照片，视频，联系人列表。
2、用户，存放在服务提供方的受保护的资源的拥有者。
3、客户端，要访问服务提供方资源的第三方应用，通常是网站。在认证过程之前，客户端要向服务提供者申请客户端标识。
用户访问客户端的网站，想操作用户存放在服务提供方的资源。
客户端向服务提供方请求一个临时令牌。
服务提供方验证客户端的身份后，授予一个临时令牌。
客户端获得临时令牌后，将用户引导至服务提供方的授权页面请求用户授权。在这个过程中将临时令牌和客户端的回调连接发送给服务提供方。
用户在服务提供方的网页上输入用户名和密码，然后授权该客户端访问所请求的资源。
授权成功后，服务提供方引导用户返回客户端的网页。
客户端根据临时令牌从服务提供方那里获取访问令牌。
服务提供方根据临时令牌和用户的授权情况授予客户端访问令牌。
客户端使用获取的访问令牌访问存放在服务提供方上的受保护的资源。
来源： http://www.phpddt.com/%E4%BA%8C%E6%AC%A1%E5%BC%80%E5%8F%91/oauth-2.html
http://player.youku.com/player.php/sid/XMzI4NzA1MDA0/v.swf
http://v.youku.com/v_show/id_XMzM5NDk1NjIw.html?from=y1.7-1-87.4.1-1.8-1-2-0
http://v.youku.com/v_show/id_XMzkyNjQwMzg0.html?from=y1.2-1-87.4.3-1.1-1-2-2
http://www.tuicool.com/articles/qqeuE3
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
What is the function of cortana?
Jan 15, 2024 pm 10:15 PM
In the process of using the Windows 10 operating system developed by Microsoft, many users are curious and confused about the new technology called Cortana. Cortana's official name in the Chinese context is "Cortana", which is actually a built-in function of the Windows 10 system. Cortana, an artificial intelligence (AIassistant) service program. Frequently asked questions and solutions. How to open Cortana and not respond. Solution steps. Chinese solution is not supported. How to put the search box into Cortana. What software is Cortana? Answer: "Cortana" It is a cloud platform personal intelligent assistant carefully built by Microsoft. It has two usage modes: login and non-login. When you are logged in
In-depth discussion of the principles and practices of the Struts framework
Feb 18, 2024 pm 06:10 PM
Principle analysis and practical exploration of the Struts framework. As a commonly used MVC framework in JavaWeb development, the Struts framework has good design patterns and scalability and is widely used in enterprise-level application development. This article will analyze the principles of the Struts framework and explore it with actual code examples to help readers better understand and apply the framework. 1. Analysis of the principles of the Struts framework 1. MVC architecture The Struts framework is based on MVC (Model-View-Con
Analysis of the function and principle of nohup
Mar 25, 2024 pm 03:24 PM
Analysis of the role and principle of nohup In Unix and Unix-like operating systems, nohup is a commonly used command that is used to run commands in the background. Even if the user exits the current session or closes the terminal window, the command can still continue to be executed. In this article, we will analyze the function and principle of the nohup command in detail. 1. The role of nohup: Running commands in the background: Through the nohup command, we can let long-running commands continue to execute in the background without being affected by the user exiting the terminal session. This needs to be run
How to get authorization for Douyin slices and goods? Is Douyin slicing easy to make?
Mar 07, 2024 pm 10:52 PM
Douyin, as a popular social media platform at the moment, not only provides people with a wealth of entertainment content, but has also become an important channel for many brands and merchants to promote products and achieve sales. Among them, Douyin’s slicing and selling products has become a novel and efficient marketing method. So, how do you get authorization for Douyin's sliced products? 1. How do you get authorization for Douyin's sliced products? Douyin's sliced products decompose long videos into short video clips and embed product promotion information in them to attract viewers to buy. . When slicing and selling goods on Douyin, the first step is to obtain authorization from the original video. When looking for a suitable licensor, you can consider using various channels such as Douyin platform, social media and industry forums. Find creators or copyright holders with popular video content and actively connect with them,
In-depth understanding of the batch Insert implementation principle in MyBatis
Feb 21, 2024 pm 04:42 PM
MyBatis is a popular Java persistence layer framework that is widely used in various Java projects. Among them, batch insertion is a common operation that can effectively improve the performance of database operations. This article will deeply explore the implementation principle of batch Insert in MyBatis, and analyze it in detail with specific code examples. Batch Insert in MyBatis In MyBatis, batch Insert operations are usually implemented using dynamic SQL. By constructing a line S containing multiple inserted values
Detailed explanation of the principle of MyBatis paging plug-in
Feb 22, 2024 pm 03:42 PM
MyBatis is an excellent persistence layer framework. It supports database operations based on XML and annotations. It is simple and easy to use. It also provides a rich plug-in mechanism. Among them, the paging plug-in is one of the more frequently used plug-ins. This article will delve into the principles of the MyBatis paging plug-in and illustrate it with specific code examples. 1. Paging plug-in principle MyBatis itself does not provide native paging function, but you can use plug-ins to implement paging queries. The principle of paging plug-in is mainly to intercept MyBatis
An in-depth analysis of the functions and working principles of the Linux chage command
Feb 24, 2024 pm 03:48 PM
The chage command in the Linux system is a command used to modify the password expiration date of a user account. It can also be used to modify the longest and shortest usable date of the account. This command plays a very important role in managing user account security. It can effectively control the usage period of user passwords and enhance system security. How to use the chage command: The basic syntax of the chage command is: chage [option] user name. For example, to modify the password expiration date of user "testuser", you can use the following command
What to do if wps authorization has expired and text cannot be entered?
Mar 20, 2024 am 09:00 AM
There are many genuine softwares in order to protect their own intellectual property rights. Before using the software, users must obtain some authorizations and obtain permission from the developer before they can use it. Some software has a trial period. After this period, you need to obtain re-authorization before you can use it normally. If wps prompts that the authorization has expired, we cannot perform any operations. How to solve this problem, let’s take a look at the explanation below. 1. I opened the WPS text program and clicked on the red box in the picture above, as shown in the picture below. 2. Click Configuration and Repair Tools. 3. Select "Advanced", as shown in the figure below. 4. Click the product management center and delete the "Expired" prompt content, as shown in the figure below. 5. After clicking "Add", enter the serial number, as shown in the figure below. 6. Then first
