OAuth 笔记

The Authorization Code Grant Type:

验证并请求code

code 来了，state验证这个请求就是我发的没错

type走得是authorization_code flow, code也是之前拿到的code,能把token拿来了嘛？

如果不使用basic authentication那么带上client id和client secret

Basic Authentication & OAuth:

得了，确认无误，token发放

Implicit Grant Type

没后端得spa用的，认证完毕token直接丢url里面给你自己拿

Too many security concerns

Client credential flow

The Resource Owner Password Credentials (ROPC) Grant Type

解决历史问题，不用了

Refresh Token

client credential为什么不用？不需要，直接请求access token就行了

直接放入query string或hash fragment安全性不高，还是用form post

Error Types:

Dealing with Native apps

Proof Key for Code Exchange(PKCE)

Links the authorization request to the token request

Open ID connection

API-to-API Delegation

Token exchange

ok