PREFACE
xv
on a wide variety of systems. I’d taught classes, given lectures, and written a handful of
articles about the subject.
So when Antonio Sanso, a well-respected security researcher in his own right,
approached me to write this book together, it made sense for me to jump in. We looked
around at what books were available on OAuth 2.0, and were unimpressed. Most of the
material we found was specific to a service: How to write an OAuth client to talk to Facebook
or Google, for instance. Or How to authorize your native application to GitHub’s API. And if
that’s all you care about, there’s plenty of material out there. But what we didn’t see
was something that would take the reader through the entire OAuth system, explain-
ing why it is designed the way that it is, pointing out its flaws and limitations as well as
its strengths. We decided that there was a need for a more comprehensive approach,
and we decided to make it the best that we could. Consequently, this book doesn’t talk
to any specific real-world OAuth provider, nor does it get into detail on a particular API
or vertical domain. Instead, this book focuses on doing OAuth for its own sake, so that
you can see how all the gears mesh together when you turn the cranks.
We built out a code framework that, we hoped, would allow readers to focus on the
core aspects of OAuth without getting overly caught up in the implementation plat-
form details. After all, we didn’t want a book that was “How to implement OAuth 2.0
on Platform Du Jour,” but rather, “How the nuts and bolts of OAuth 2.0 work so you
can use whatever platform you want.” So we went with a relatively simple Node.js
framework, built on Express.js, and liberally used library code to abstract away the
platform-specific weirdness as much as possible. Still, it’s JavaScript, so some of that
weirdness crept in from time to time, as it would on any platform. But it’s our hope that
you will be able to apply the methods and themes used here to your chosen language,
platform, and architecture.
Speaking of histories, how did we even get here? The story starts in 2006, when
several web service companies, including Twitter and Ma.Gnolia, had complementary
applications and wanted their users to be able to connect them together. At the time,
this type of connection was typically accomplished by asking the user for their creden-
tials on the remote system and sending those credentials to the API. However, the web-
sites in question used a distributed identity technology, OpenID, to facilitate login. As
a consequence, there were no usernames or passwords that could be used for the API.
To overcome this, the developers sought to create a protocol that would allow their
users to delegate access to the API. They based their new protocol on several propri-
etary implementations of this same concept, including Google’s AuthSub and Yahoo!’s
BBAuth. In all of these, a client application is authorized by a user and receives a token
that can then be used to access a remote API. These tokens were all issued with a public
and private portion, and this protocol used a novel (if in retrospect fragile) crypto-
graphic signing mechanism so that it could be used over non-TLS HTTP connections.
They called their protocol OAuth 1.0 and published it as an open standard on the web.
剩余361页未读，继续阅读
hunkpei
- 粉丝: 5
- 资源: 32
我的内容管理
展开
最新资源
- Vue实现iOS原生Picker组件：详细解析与实现思路
- Arduino蓝牙小车：参数调试与功能控制
- 百度Java面试精华：200页精选资源涵盖核心知识点
- Swift使用CoreData填坑指南：CoreData在Swift 3.0的变化
- 微距离无线充电器创新设计及其实验探索
- MTK Android平台开发全攻略：44步详解流程
- RecyclerView全面解析：替代ListView的新选择
- Android开发：自动适配中英文键盘解决方案
- Android调用WebService接口教程
- Android开发：BitmapUtil图片处理全解析与实例
- Android多线程断点续传实现详解
- PCA算法在人脸识别会议签到系统中的应用
- EventBus 3.0：Android事件总线详解与实战应用
- Android FileUtil：全面解析文件操作实用技巧与实例
- RecyclerView添加头部和尾部实战教程
- Android实现微博滑动固定顶部栏实战与优化
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
