scribe 在oauth 2.0 中不支持refresh_token 对吧？

发布于 2024-12-25 05:39:59 字数 991 浏览 1 评论 0原文

我发现 scribe 不会提取访问令牌中的 refresh_token 。

OAuth 1.0 提取器包含：

Preconditions.checkEmptyString(response, "Response body is incorrect. Can't extract a token from an empty string");
String token = extract(response, TOKEN_REGEX);
String secret = extract(response, SECRET_REGEX);
return new Token(token, secret, response);

其中包含令牌秘密。

但在OAuth2.0中，没有令牌秘密，而是用refresh_token代替。 Scribe 简单地忽略它：

Preconditions.checkEmptyString(response, "Cannot extract a token from a null or empty String");
Matcher matcher = accessTokenPattern.matcher(response);
if(matcher.find())
{
  return new Token(matcher.group(1), "", response);
}
else
{
  throw new OAuthException("Cannot extract an acces token. Response was: " + response);
}

这会导致问题。访问令牌将来可能会过期。我必须在每次登录过程中通过保存的刷新令牌来刷新访问令牌，但无法直接获取它。

我计划改进抄写员添加此功能（这并不难）...但是有人已经这样做了吗？

原文

I found that scribe does not extract refresh_token in access token.

The OAuth 1.0 extractor contains:

Preconditions.checkEmptyString(response, "Response body is incorrect. Can't extract a token from an empty string");
String token = extract(response, TOKEN_REGEX);
String secret = extract(response, SECRET_REGEX);
return new Token(token, secret, response);

Which contains token secret.

But in OAuth2.0, there is no token secret, but refresh_token instead. Scribe simply ignores it:

Preconditions.checkEmptyString(response, "Cannot extract a token from a null or empty String");
Matcher matcher = accessTokenPattern.matcher(response);
if(matcher.find())
{
  return new Token(matcher.group(1), "", response);
}
else
{
  throw new OAuthException("Cannot extract an acces token. Response was: " + response);
}

This causes a problem. The access token may expire in the future. I have to refresh access token by saved refresh token in every login pregress, but there is no way to get it directly.

I planned to improve scribe add this feature (it's not difficult)... but has anyone already done this ?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

娇妻 2025-01-01 05:39:59

你说的是真的。 Scribe 不会为您提供访问令牌的刷新方法。 Scribe 旨在让 OAuth 签名变得简单。 OAuth2.0 非常简单，如果每个人都在使用 OAuth2，那么抄写员可能就没有意义了（它在 1.0a 流程上大放异彩）。

无论如何，您可以轻松地执行刷新步骤，如下所示：

OAuthRequest request = new OAuthRequest(Verb.POST, "http://server.example.com/token");
request.addBodyParameter("grant_type", "refresh_token");
request.addBodyParameter("refresh_token", accessToken.getToken()); // were accessToken is the Token object you want to refresh.

request.send();

希望有帮助！

What you say is true. Scribe doesn't give you a refresh method for your access tokens. Scribe was meant to make OAuth signatures easy. OAuth2.0 is pretty easy and if everybody were doing OAuth2, there would be arguably no purpose for scribe (it shines on 1.0a flows).

Anyway, you can easily do the refresh step like this:

OAuthRequest request = new OAuthRequest(Verb.POST, "http://server.example.com/token");
request.addBodyParameter("grant_type", "refresh_token");
request.addBodyParameter("refresh_token", accessToken.getToken()); // were accessToken is the Token object you want to refresh.

request.send();

Hope that helps!

回复收藏 0 原文

风铃鹿 2025-01-01 05:39:59

您可以使用以下代码来做到这一点（以谷歌提供商为例）

OAuthRequest request = new OAuthRequest(Verb.POST,"https://accounts.google.com/o/oauth2/token");
    request.addBodyParameter("grant_type", "refresh_token");
    request.addBodyParameter("refresh_token", accessToken.getToken()); // were accessToken is the Token object you want to refresh.
    request.addBodyParameter("client_id", your clientID);
    request.addBodyParameter("client_secret", your clientSecret);
    Response response = request.send();

You can do that using the following code (google provider as example)

OAuthRequest request = new OAuthRequest(Verb.POST,"https://accounts.google.com/o/oauth2/token");
    request.addBodyParameter("grant_type", "refresh_token");
    request.addBodyParameter("refresh_token", accessToken.getToken()); // were accessToken is the Token object you want to refresh.
    request.addBodyParameter("client_id", your clientID);
    request.addBodyParameter("client_secret", your clientSecret);
    Response response = request.send();

回复收藏 0 原文

~没有更多了~