OAuth2.0授权机制说明
授权机制说明
1 简介
优酷对第三方应用用户授权采用OAuth2.0标准
2 OAuth2.0 授权方式
优酷支持OAuth 2.0的三种授权方式，请根据平台选用不同的授权方式：
2.1 通用授权方式
Web应用授权 Authorization Code Grant
说明
Web应用授权分为两步
1 请求用户到优酷授权，授权成功后将授权码以URL跳转的形式传给第三方网站
2 第三方网站根据授权码换取Access Token
交互流程图
+----------+
| resource |
| owner |
| |
+----------+
^
|
(B)
+----|-----+ Client Identifier +---------------+
| -+----(A)-- & Redirection URI ---->| |
| User- | | Authorization |
| Agent -+----(B)-- User authenticates --->| Server |
| | | |
| -+----(C)-- Authorization Code ---<| |
+-|----|---+ +---------------+
| | ^ v
(A) (C) | |
| | | |
^ v | |
+---------+ | |
| |>---(D)-- Authorization Code ---------' |
| Client | & Redirection URI |
| | |
| |<---(E)----- Access Token -------------------'
+---------+ (w/ Optional Refresh Token)
交互步骤
授权请求
GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb&scope=a%20b Host: server.example.com
授权成功跳转
HTTP/1.1 302 Found Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA&state=xyz
Access Token 请求
POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb
Access Token 返回
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}
详细接口文档见 查看
2.2 用户名密码授权
客户端应用（不支持WebView）Resource Owner Password Credentials Grant
只有合作级别的桌面客户端或移动客户端应用才可以调用
说明
客户端应用授权只需一步
1 通过用户名密码直接换取Access Token
交互流程图
+----------+
| Resource |
| Owner |
| |
+----------+
v
| Resource Owner
(A) Password Credentials
|
v
+---------+ +---------------+
| |>--(B)---- Resource Owner ------->| |
| | Password Credentials | Authorization |
| Client | | Server |
| |<--(C)---- Access Token ---------<| |
| | (w/ Optional Refresh Token) | |
+---------+ +---------------+
交互步骤
Access Token 请求
POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded;charset=UTF-8 grant_type=password&username=johndoe&password=A3ddj3w
Access Token 返回
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}
接口文档见 查看
2.3 Javascript应用
Javascript应用授权 Implicit Grant
说明
Javascript应用授权分为两步
1 请求用户到优酷授权，授权成功后将Access Token以URL跳转的形式传给第三方网站
2 第三方网站通过Javascript从跳转URL中直接取到Access Token
交互流程图
+----------+
| Resource |
| Owner |
+----------+
^
(B)
+----|-----+ Client Identifier +---------------+
| -+----(A)-- & Redirection URI --->| |
| User- | | Authorization |
| Agent -|----(B)-- User authenticates -->| Server |
| | | |
| |<---(C)--- Redirection URI ----<| |
| | with Access Token +---------------+
| | in Fragment
| | +---------------+
| |----(D)--- Redirection URI ---->| Web-Hosted |
| | without Fragment | Client |
| | | Resource |
| (F) |<---(E)------- Script ---------<| |
| | +---------------+
+-|--------+
(A) (G) Access Token
| |
^ v
+---------+
| Client |
+---------+
交互步骤
授权请求
GET /authorize?response_type=token&client_id=s6BhdRkqt3&state=xyz&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb&scope=a%20b Host: server.example.com
授权成功跳转
HTTP/1.1 302 Found Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA&state=xyz&token_type=example&expires_in=3600&scope=a%20b
授权失败
HTTP/1.1 302 Found Location: https://client.example.com/cb#error=access_denied&state=xyz
接口文档见 查看
3 OAuth2.0 SDK
4 OAuth2.0 资源
官方网站 http://oauth.net/2/