OAuth 令牌安全
据我所知，OAuth 标准对于 OAuth 的实际行为非常宽松，但是...
我将各种 OAuth 服务的 OAuth 访问令牌存储在数据库中。如果这些代币被泄露，它们是否可以被第三方使用？即，给定的令牌是否仅绑定到我的 api 和密钥？
As far as I know, the OAuth standard is very lax on how OAuth really should behave, but...
I store OAuth access tokens for various OAuth services in a database. If these tokens were compromised, could they be used by a third party? I.e., are the given tokens bound to only my api and secret keys?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
令牌与给定的服务和用户绑定。有了这些，人们就可以假装是该用户。
例如，它不与任何 IP 地址或设备 UUID 绑定（尽管可以这样做作为额外的预防措施，但这不是 OAuth 的一部分）。
如果它们被泄露，您将取消它们的授权，从而使它们变得毫无价值。
不会。访问令牌还与为其颁发的应用程序相关联。
这样，用户可以按应用程序取消授权，并且每个应用程序都可以拥有一组不同的权限（例如只读访问权限）。
The tokens are tied to a given service and user. With those, one can pretend to be that user.
It is not tied to any IP address or device UUID for example (although one could do that as an additional precaution, but that is not part of OAuth).
If they were compromised, you'd deauthorize them, thus making them worthless.
No. The access token are also tied to the application they were issued for.
This way the user can de-authorize on a by-application basis, and every app can have a different set of permissions (e.g. read-only access).