为什么不可能窃取访问令牌？
我正在学习 OAuth，我脑子里有一个问题，我找不到答案。
我理解请求令牌来授权或不授权应用程序使用 API。但是，一旦用户获得了访问令牌，如果有人窃取了他的访问令牌，会发生什么情况？
想象一下，我们有类似 http://www.example.com/api/article/ 1?access_token=*****access_token******
如果我将此网址提供给其他用户，其他用户将获得我的访问权限，因此 API 不再受到保护？
I'm learning OAuth and I have a question in head I can't find an anwser..
I understood request token to authorize or not an application to use the API. But once the user got an access token, what happens if someone steal his access token?
Imagine that we have something like http://www.example.com/api/article/1?access_token=******access_token******
If I give this url to another user, the other would have my access and so the API isn't protected anymore?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
简短回答：是的，对于 OAuth2 - 拥有有效 access_token 的人都可以访问该令牌指定的资源。持续多久取决于 OAuth2 提供者的实现。
关于 OAuth1 和 2 的长答案：
当涉及 OAuth 1 时，访问令牌是还不够。您还需要访问令牌秘密以及消费者密钥和秘密。保持访问令牌的机密性并限制其范围和有效时间仍然是件好事，但如果没有客户端和令牌机密，则无法使用访问令牌。 OAuth 1 不要求您使用 SSL，因为加密技术已内置于规范中。
OAuth 2 是不同的 - 访问令牌的保密可以说更重要。因此，API 提供商应确保访问令牌（在 OAuth2 中也称为承载令牌）仅在尽可能短的时间内有效。这些令牌的工作方式类似于密码，如果被拦截，攻击者可以立即使用。因此，OAuth2（带有不记名令牌）规范要求所有通信都通过 SSL 进行 - 因为规范中没有内置加密技术。通常，访问令牌具有较短的有效性，可以使用具有较长有效性的“刷新令牌”进行刷新，但仅在消费者接收到初始不记名令牌以及刷新不记名令牌时才传输。
Short answer: Yes, for OAuth2 - whoever has a valid access_token would have access to resources designated by that token. For how long depends on OAuth2 the implementation of provider.
Long answer, about both OAuth1 and 2:
When it comes to OAuth 1 an access token is not enough. You would also need the access token secret and also consumer key and secret. It is still good to keep the access tokens confidential, and to limit their scope and time of validity but you cannot use the access token without client and token secrets. OAuth 1 doesn't require that you use SSL, because cryptography is built right into the specification.
OAuth 2 is different - it is arguably more important that access tokens are kept confidential. Therefore the API provider should ensure that access tokens, which in OAuth2 are also known as Bearer tokens, are valid only for as short time as possible. These tokens work like passwords, and if intercepted can be used immediately by an attacker. Therefore the OAuth2 (with bearer token) specification requires that all communication takes place over SSL - since no cryptography is built into the specification. Typically access tokens have a short validity, which can be refreshed with a "refresh token" which has longer validity but is only transfered when the initial bearer token is received by the consumer, and when a bearer token is refreshed.