REST 中的 OAuth 令牌和会话
另一分钟我读了一篇关于 OAuth 的文章。它特别描述了在一系列请求期间客户端和服务提供商之间交换的令牌。
该文章还提到，OAuth 作为授权层在 RESTful API 中获得了广泛的欢迎。据我了解，REST 应该保持完全无状态。
问题是：这种重复的代币交换是否会破坏 REST 的“无状态”原则？恕我直言，令牌可以被视为一种会话 ID，不是吗？
The other minute I read an article on OAuth. It described especially the tokens being exchanged between client and service provider during a series of requests.
The article also mentioned that OAuth gains significant popularity in RESTful APIs as authorization layer. As I understood, REST should be kept completely stateless.
The question: Doesn't this repeated token exchange torpedo REST's "being stateless" principle? IMHO the tokens can be seen as a kind of session ID, can't they?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
OAuth 令牌是明确的会话标识符，OAuth 令牌协商协议中的请求之间的交互不是无状态的，因为请求必须按特定顺序执行，并且它们确实需要服务器上的每个客户端存储，因为您需要跟踪诸如何时之类的事情他们被发行了。所以，是的，OAuth 确实违反了 RESTful 架构的严格原则。
不幸的是，在现实世界中，我们需要做一些事情，比如允许应用程序代表个人进行身份验证而不请求他们的密码，OAuth 在这方面做得相当好。如果没有这种状态，就不可能实现类似的安全认证方案。事实上，OAuth (1.0a) 所需的更改之一是向令牌协商协议添加更多状态以减轻安全风险。
那么，它是否破坏了 REST 的无状态原则？是的。这有关系吗？除非你住在象牙塔里:-)
OAuth tokens are explicitly a session identifier, interaction is not stateless between requests in the OAuth token negotiation protocol as the requests must be performed in a specific sequence, and they do require per-client storage on the server as you need to track things like when they were issued. So yes, OAuth does violate the strict principles of a RESTful architecture.
Unfortunately there's the Real WorldTM to contend with where we need to do things like allow applications to authenticate on the behalf of individuals without requesting their password, which OAuth does fairly well. It would be impossible to implement a similarly secure authentication scheme without this kind of state. Indeed, one of the changes required by OAuth (1.0a) was to add more state to the token negotiation protocol to mitigate a security risk.
So, does it torpedo REST's stateless principle? Yes. Does that matter? Not unless you live in an ivory tower :-)
身份验证是一种在处理 Web 交互时必须以某种方式跟踪的状态。最终，无论您的应用程序是否是静态的，服务器都必须能够跟踪每个用户的“经过身份验证的状态”，不幸的是，这需要对 HTTP 的底层无状态性质以及任何其他传输/技术（如 REST）进行某种规避。它。
因此，要开发任何类型的经过身份验证的应用程序，必须在某个地方硬塞一个状态原则，如果恰好是 REST 之上的 OAuth，那就一定是这样！
Authentication is a state that must be tracked somehow when dealing in web interactions. Ultimately if your app is restful or not, the server must be able to track each users "authenticated state" and unfortunately that requires some kind of circumvention of the underlying stateless nature of HTTP and any additional transports/techniques (like REST) on top of it.
Hence to develop any kind of authenticated app, a principle of state must be shoe horned in somewhere, and if that so happens to be OAuth on top of REST, thats how it must be!