解析 OAuth 2.0 token responses
OAuth 2.0 returns access_token, token_type, expires_in, 和 optionally refresh_token. Learn 到解析和 use 令牌响应正确.
- 1
OAuth 2.0 令牌响应是 JSON object: {access_token, token_type: "Bearer", expires_in: 3600, refresh_token, 作用域}. access_token 是 used 在 Authorization 头. refresh_token obtains 新 access_token 当它 expires. Store refresh_token 安全 (HttpOnly Cookie) — 它有 longer lifetime 和 greater access.
- 2 JWT 解码器 →
解码 the access_token if it is a JWT. Inspect the claims (sub, exp, scope, iss, aud) to understand the token's permissions and expiration. If it is an opaque token, call the introspection endpoint to get the token info.
- 3 JSON 格式化器 →
格式化 the token response JSON to inspect all fields. Verify: token_type is "Bearer", expires_in is reasonable (3600 = 1 hour), scope matches what you requested. Store the expiration timestamp to proactively refresh before expiry.
常见问题
- 什么是 refresh 令牌?
- refresh 令牌是 credential used 到 obtain 新 access 令牌当 当前 one expires. 它有 longer lifetime (days 到 weeks) 和是 stored 安全 (HttpOnly Cookie, 安全 storage). access 令牌是 short-lived (minutes 到 hours) 和 sent 到 APIs. 此 limits exposure window 如果 access 令牌是 stolen.
- 什么是 token_type 字段?
- 它 indicates 如何use 令牌. "Bearer" means put 它在 Authorization 头: "Authorization: Bearer <令牌>". 此是 仅宽 supported 类型. 其他 types (MAC, POP) 是 proposed 但不 adopted. 总是检查 token_type 和 use 正确 mechanism.