使用访问令牌获取访问令牌？
据我了解，迄今为止，关于访问令牌是在代码流中，客户端可以使用授权代码或刷新令牌获得访问令牌。
但是..它可以在代币过期之前使用访问令牌获得新的访问令牌吗？
我阅读 rfc6749 时间），我找不到
“访问令牌必须仅由明确资源所有者的赠款或刷新令牌发行”
所以我一直在想。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。
“访问令牌
这怎么了？
我几乎是菜鸟，只用互联网就学到了它，所以我可能会完全误解一些d：
请启发我..谢谢！
From what I understand so far about access token is that in Code flow, Client could get access token with either authorization code or refresh token.
But.. can it get new access token with access token it holds before the token's expired?
I read RFC6749(1.1 ~ 1.4, 4.1, 4.2, 5 sections only for the sake of time) and I couldn't find such that
"access token must get issued by only explicit resource owner's grant or refresh token"
So I've been thinking..
How about issuing access token with access token.
What's wrong with this?
I'm almost noob to OAuth and learned it with only internet so I might totally misunderstand something D:
please enlighten me.. thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您不能使用访问令牌获取新的访问令牌。访问令牌是自包含的携带者令牌，可允许您访问某些数据。 （用范围表示）出于安全原因访问令牌的寿命有限。一旦过期，您将无法使用它。
考虑是否有恶意意图的人掌握了您的访问令牌。然后，他们可以使用它来访问数据，但只能在有限的时间内。访问令牌过期后，他们将无法访问该数据。
刷新访问
验证过程的第一步为您提供了授权代码，这是一个一次性代码，大概五分钟的时间很短，只能使用一次。如果您要求脱机访问权限，则将其交换时，您将获得访问令牌和刷新令牌。
刷新令牌可用于获得新的访问令牌。您可以使用它在以后的日期获取访问权限，而无需再次请求用户访问。为了获得新的访问令牌，尽管您需要拥有用于创建访问令牌的客户端和客户端的秘密，在某些情况下，您需要可以访问重定向URI所居住的服务器。这样，如果一个恶意的人可以访问其刷新令牌，除非他们拥有您的，客户ID，客户端分泌和服务器访问权限，否则无法使用它来获得新的访问令牌。
您可能会发现这个有趣的用curl 了解oauth2
You cant use an access token to get a new access token. Access tokens are self contained bearer tokens which grant you access to some data. (denoted by scope) For security reasons access tokens have a limited life time. Once it has expired you can not longer use it.
Consider if someone with a malicious intent got a hold of your access token. They can then use this to access the data, but only for a limited amount of time. Once the access token expired they would no longer be able to access that data.
refreshing access
The first step of the auth process gives you an authorization code, this is a one time code extremely short lived probably five minutes and can only be used once. When you exchange this you will get an access token and a refresh token if you requested offline access.
Refresh tokens can be used to get a new access token. You can use it to get access at a later date without requesting access of the user again. To get a new access token though you need to have the client and i and client secret that were used to create the access token in the first place, and in some cases you need to have access to the server that the redirect uri is residing. This way if the same a malicious person got access to their refresh token they cant use it to get a new access token unless they have your , client id, client secrete and server access.
You may find this interesting Understanding oauth2 with curl
TLDR
可以撤销访问权限。刷新令牌用于此。
这是我的理解。访问令牌不会由发出的验证服务器保留。它们的尺寸很大，在一般情况下可能有很多，每个范围或一组范围。刷新令牌是简短的不透明字符串，由Auth Server保留。如果发现用户的系统受到损害，则可以将它们无效以撤销身份验证。例如，如果攻击者获得了访问/刷新令牌，并从其他IP中使用了它们。在这种情况下，Auth Server将针对保留的刷新令牌设置标志，并且不会在不重新认证的情况下刷新访问令牌。
TLDR
To be able to revoke access. Refresh token is used for that.
Here is my understanding. Access token are not retained by the auth server that issued them. They are very large in size and there may be a great number of them in a general case, one per scope or a set of scopes. Refresh tokens are short opaque strings and are retained by the auth server. They can be invalidated by the auth server to revoke authentication if a user's system has been found compromised. If an attacker obtained access/refresh token and used them from a different IP, for example. In this case the auth server will set a flag against the retained refresh token and will not refresh an access token without re-authentication.