我有几个问题...
- yahoo 和 microsoft api 支持吗
oAuth 2.0？
- 如果是的话主要是什么
应采取的安全措施
转移时得到照顾
oAuth 1.0 到 oAuth 2.0。
- Google API 支持 oAuth 2.0。但
他们仍然将其标记为
实验性的。好开始吗
即使它正在转移
实验性的？
-
我在注册时看到
google 上的应用程序（用于 oAuth
2.0)，他们要求回调 url。如果单个应用程序使用
条件相关的回调 url
比如-
if($myVar == NULL) $callbackUrl = 'http://www.mydomain.com/test.php?m=f¶ms=null'
else $callbackUrl = 'http://www.mydomain.com/test.php?m=x¶ms=1'
当回调 url 已指定时，我如何实现上述功能？上述条件主要处理应用程序的后备模型，或者如果浏览器支持 java，则处理基于 java 的应用程序模型。请建议
- 我可以知道有多少电子邮件吗
提供网站和社交
网络支持 oAuth 2.0？
i have several questions...
- Does yahoo and microsoft api support
oAuth 2.0?
- If yes then what are the main
security measures those should be
taken care of while shifting from
oAuth 1.0 to oAuth 2.0.
- Google API supports oAuth 2.0. But
they have still marked it as an
experimental. Is it good to start
shifting even though it is
experimental?
-
I see while registering an
application on google (for oAuth
2.0), they ask for callback url. If a single application uses a
condition dependent callback url
such as -
if($myVar == NULL) $callbackUrl = 'http://www.mydomain.com/test.php?m=f¶ms=null'
else $callbackUrl = 'http://www.mydomain.com/test.php?m=x¶ms=1'
How can i implement above when the callback url is already specified? The above conditional mainly handles fallback model of an application or if browser supports java then java based model of an application. Kindly suggest
- May i know how many of email
providing websites and social
networks supports oAuth 2.0?
发布评论
评论（1）
Yahoo 尚不支持 OAuth2，仅支持 Oauth 1。
Microsoft 确实支持 OAuth2。 http://msdn.microsoft.com/en-us/library/hh243647。 .aspx
Oauth 2 更简单，因为它使用 SSL (HTTPS) 提供传输安全性，因此不需要签名和令牌秘密。当您切换时，您将需要重新实现 OAuth 流程。我想不出任何具体适用于从 OAuth1 升级到 OAuth2 的具体安全措施，但规范在 第 10 条 （适用于客户端的部分为 10.3， 10.4、10.5、10.6、10.8 和 10.9）。
OAuth2 规范尚未最终确定，并且可能会发生变化。您可以开始使用 Google 实施您的 OAuth2 流程，但请记住，参数、端点等的名称或要求可能会发生变化，并且您的应用程序将中断/您将需要进行更改。未来。 [实验功能]可能随时更改（甚至被删除）。在关键的生产环境中使用实验（或测试版）软件可能是一个坏主意。
此外，目前并非所有 Google 服务都支持 OAuth2。例如。如果您想使用 OAuth 通过 IMAP 访问 Gmail，您现在必须使用 OAuth1。
在 API 控制台中，您可以为 OAuth2 应用程序指定多个回调网址，其中一个每行。另一种方法是将您的“m”和“params”参数存储在浏览器会话/cookie 中，并在授权完成后重定向到正确的页面。
支持（某些修订版）OAuth2：Facebook、Microsoft/Live、Google（上述例外）、Foursquare、GitHub、Gowalla、GeoLoqi、Salesforce。
仅支持 OAuth1：Yahoo、Flickr、Twitter< /a>.
来源。
Yahoo does not support OAuth2 yet, only Oauth 1.
Microsoft does support OAuth2. http://msdn.microsoft.com/en-us/library/hh243647.aspx
Oauth 2 is simpler since it uses SSL (HTTPS) to provide transport security, so the signatures and token-secrets are not needed. When you switch you will need to re-implement your OAuth flow. I can't think of any specific security measures specifically applicable to upgrading from OAuth1 to OAuth2, but the spec details some security considerations in section 10 (The parts applicable to clients are 10.3, 10.4, 10.5, 10.6, 10.8 and 10.9).
The OAuth2 specification is still not finalized, and may change. You could begin to implement your OAuth2 flow with Google, but bear in mind that it is possible that names or requirements of parameters, endpoints etc. could change and your application will break / you will need to make changes in future. [Experimental Features] could change (or even be removed) at any time. It is probably a bad idea to use experimental (or beta) software in a critical production environment.
Also, not all Google services support OAuth2 at the moment. eg. If you want to use OAuth for IMAP access to Gmail you will have to use OAuth1 for now.
In the API Console, you can specify multiple callback URLs for your OAuth2 application, one per line. An alternative would be to store your 'm' and 'params' parameters in a browser session / cookie and do the redirect to the correct page once authorization is complete.
Support (some revision of) OAuth2: Facebook, Microsoft/Live, Google (with exceptions described above), Foursquare, GitHub, Gowalla, GeoLoqi, Salesforce.
Support OAuth1 Only: Yahoo, Flickr, Twitter.
Source.