OAuth 2.0 流程

复制import requests
from urllib.parse import urlencode, urljoin

# 授权码模式（Authorization Code）客户端示例
CLIENT_ID = "your_client_id"
CLIENT_SECRET = "your_client_secret"
REDIRECT_URI = "https://your-app.com/callback"
AUTH_ENDPOINT = "https://provider.com/oauth2/authorize"
TOKEN_ENDPOINT = "https://provider.com/oauth2/token"

# 1. 构造授权请求 URL（用户浏览器跳转）
params = {
    "response_type": "code",
    "client_id": CLIENT_ID,
    "redirect_uri": REDIRECT_URI,
    "scope": "openid profile",
    "state": "random_state_string"  # 防 CSRF
}
auth_url = f"{AUTH_ENDPOINT}?{urlencode(params)}"
print(f"Redirect user to: {auth_url}")

# 2. 回调后，用授权码交换令牌（服务端执行）
authorization_code = "code_from_callback"  # 从 query 参数获取

token_data = {
    "grant_type": "authorization_code",
    "code": authorization_code,
    "redirect_uri": REDIRECT_URI,
    "client_id": CLIENT_ID,
    "client_secret": CLIENT_SECRET
}
response = requests.post(TOKEN_ENDPOINT, data=token_data)
if response.status_code == 200:
    token = response.json()
    print(f"Access token: {token['access_token']}")
    print(f"Refresh token: {token.get('refresh_token')}")
else:
    print(f"Token exchange failed: {response.text}")

复制package main

import (
	"context"
	"fmt"
	"golang.org/x/oauth2"
)

func main() {
	// 客户端凭证模式（Client Credentials）—— 服务到服务认证
	conf := &oauth2.Config{
		ClientID:     "your_client_id",
		ClientSecret: "your_client_secret",
		Scopes:       []string{"api:read"},
		Endpoint: oauth2.Endpoint{
			TokenURL: "https://provider.com/oauth2/token",
		},
	}

	// 直接获取令牌，无需用户交互
	token, err := conf.TokenSource(context.Background(), &oauth2.Token{}).Token()
	if err != nil {
		fmt.Printf("Failed to get token: %v\n", err)
		return
	}

	fmt.Printf("Access token: %s\n", token.AccessToken)
	fmt.Printf("Token type: %s\n", token.TokenType)
	fmt.Printf("Expires in: %v\n", token.Expiry)

	// 使用令牌访问受保护资源
	client := conf.Client(context.Background(), token)
	resp, err := client.Get("https://api.provider.com/v1/resource")
	if err != nil {
		fmt.Printf("API call failed: %v\n", err)
		return
	}
	defer resp.Body.Close()
	fmt.Printf("API response status: %s\n", resp.Status)
}

复制// 隐式模式（Implicit）—— 纯前端 SPA 示例（已不推荐，仅作演示）
// 实际生产应使用授权码 + PKCE

// 1. 生成 PKCE 验证码和挑战（推荐替代隐式模式）
function generatePKCE() {
  const verifier = Array.from(crypto.getRandomValues(new Uint8Array(32)))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
  
  // 生成 SHA-256 挑战
  return crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
    .then(hash => {
      const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=+$/, '');
      return { verifier, challenge };
    });
}

// 2. 构造授权请求（PKCE 增强的授权码模式）
async function startAuth() {
  const { verifier, challenge } = await generatePKCE();
  
  // 保存验证码到 localStorage（回调时使用）
  localStorage.setItem('pkce_verifier', verifier);
  
  const params = new URLSearchParams({
    response_type: 'code',
    client_id: 'your_client_id',
    redirect_uri: 'https://your-app.com/callback',
    code_challenge: challenge,
    code_challenge_method: 'S256',
    state: crypto.randomUUID(),
    scope: 'openid profile'
  });
  
  window.location.href = `https://provider.com/oauth2/authorize?${params}`;
}

// 3. 回调处理：用授权码 + PKCE 验证码换令牌
async function exchangeCode(code) {
  const verifier = localStorage.getItem('pkce_verifier');
  localStorage.removeItem('pkce_verifier');
  
  const response = await fetch('https://provider.com/oauth2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: code,
      redirect_uri: 'https://your-app.com/callback',
      client_id: 'your_client_id',
      code_verifier: verifier
    })
  });
  
  if (!response.ok) throw new Error('Token exchange failed');
  const token = await response.json();
  console.log('Access token:', token.access_token);
  return token;
}