OAuth 2 实战：客户端与服务器端的应用与安全实践

需积分: 10 132 浏览量更新于2024-07-19 收藏 14.21MB PDF 举报

"OAuth 2 in Action 是一本深入讲解OAuth 2协议实战应用与部署的书籍，涵盖了客户端、授权服务器和资源服务器三个视角。作者通过实际案例教你如何在客户端和服务器端安全地构建和实施OAuth 2。" OAuth 2是互联网上广泛使用的授权框架，它允许第三方应用在用户的许可下访问特定的受保护资源，而无需获取用户的用户名和密码。本书"OAuth 2 in Action"由Justin Richer和Antonio Sanso合著，旨在帮助开发者深入理解OAuth 2的实践应用和安全考虑。在客户端方面，读者将学习如何构建能够正确处理OAuth 2授权流程的应用程序，包括如何引导用户进行授权，接收访问令牌，并使用这些令牌安全地请求资源。同时，书中会探讨不同类型的授权流，如授权码流、隐式流、资源所有者密码凭证流和客户端凭证流，以及它们各自的适用场景。在授权服务器部分，书中的内容将涵盖如何设置和管理用户授权，实现安全的令牌颁发和验证机制，以及如何防止常见的安全威胁，如重放攻击和令牌盗窃。此外，还会讨论如何实现刷新令牌以延长用户会话的有效性。作为资源服务器，读者将了解如何保护API，确保只有经过授权的客户端可以访问受保护的数据。这包括设置权限边界、使用访问令牌验证以及处理令牌过期等策略。除此之外，书中还会涉及OAuth 2与其他身份验证协议（如OpenID Connect）的集成，以及如何在实际部署中考虑安全性、性能和用户体验。 "OAuth 2 in Action"不仅适合有经验的开发者，也适合初学者。书中通过实例代码和详细的解释，使读者能轻松掌握OAuth 2的核心概念和技术。同时，书中还提醒读者注意版权信息，尊重出版商的权益，未经许可不得复制或传播内容。这是一本全面且深入的OAuth 2教程，对于任何想要在实际项目中实施OAuth 2的开发者来说，都是一份宝贵的参考资料。

preface xv

on a wide variety of systems. I’d taught classes, given lectures, and written a handful of

articles about the subject.

So when Antonio Sanso, a well-respected security researcher in his own right,

approached me to write this book together, it made sense for me to jump in. We looked

around at what books were available on OAuth 2.0, and were unimpressed. Most of the

material we found was specific to a service: How to write an OAuth client to talk to Facebook

or Google, for instance. Or How to authorize your native application to GitHub’s API. And if

that’s all you care about, there’s plenty of material out there. But what we didn’t see

was something that would take the reader through the entire OAuth system, explain-

ing why it is designed the way that it is, pointing out its flaws and limitations as well as

its strengths. We decided that there was a need for a more comprehensive approach,

and we decided to make it the best that we could. Consequently, this book doesn’t talk

to any specific real-world OAuth provider, nor does it get into detail on a particular API

or vertical domain. Instead, this book focuses on doing OAuth for its own sake, so that

you can see how all the gears mesh together when you turn the cranks.

We built out a code framework that, we hoped, would allow readers to focus on the

core aspects of OAuth without getting overly caught up in the implementation plat-

form details. After all, we didn’t want a book that was “How to implement OAuth 2.0

on Platform Du Jour,” but rather, “How the nuts and bolts of OAuth 2.0 work so you

can use whatever platform you want.” So we went with a relatively simple Node.js

framework, built on Express.js, and liberally used library code to abstract away the

platform-specific weirdness as much as possible. Still, it’s JavaScript, so some of that

weirdness crept in from time to time, as it would on any platform. But it’s our hope that

you will be able to apply the methods and themes used here to your chosen language,

platform, and architecture.

Speaking of histories, how did we even get here? The story starts in 2006, when

several web service companies, including Twitter and Ma.Gnolia, had complementary

applications and wanted their users to be able to connect them together. At the time,

this type of connection was typically accomplished by asking the user for their creden-

tials on the remote system and sending those credentials to the API. However, the web-

sites in question used a distributed identity technology, OpenID, to facilitate login. As

a consequence, there were no usernames or passwords that could be used for the API.

To overcome this, the developers sought to create a protocol that would allow their

users to delegate access to the API. They based their new protocol on several propri-

etary implementations of this same concept, including Google’s AuthSub and Yahoo!’s

BBAuth. In all of these, a client application is authorized by a user and receives a token

that can then be used to access a remote API. These tokens were all issued with a public

and private portion, and this protocol used a novel (if in retrospect fragile) crypto-

graphic signing mechanism so that it could be used over non-TLS HTTP connections.

They called their protocol OAuth 1.0 and published it as an open standard on the web.

xvi preface

It quickly gained traction, and free implementations in several languages were made

available alongside the specification itself. It worked so well and developers liked it so

much that even the large internet companies soon deprecated their own proprietary

mechanisms that had inspired OAuth in the first place.

As happens with many new security protocols, a flaw was found early on in OAuth

1.0’s life, leading to the development of OAuth 1.0a to close a session fixation vulner-

ability. This version was later codified in the IETF as RFC 5849. At this point, a commu-

nity was beginning to grow around the OAuth protocol, and new use cases were being

developed and implemented. Some of these pushed OAuth into places that it was

never meant to be used in, but these off-label OAuth uses worked better than any avail-

able alternatives. Still, OAuth 1.0 was a monolithic protocol designed to provide one

mechanism to solve all use cases, and it was venturing into uncomfortable territory.

Soon after the publication of RFC 5849, the Web Resource Access Protocol (WRAP)

was published. This proposed protocol took the core aspects of the OAuth 1.0a pro-

tocol—a client, delegation, and tokens—and expanded them to be used in different

ways. WRAP did away with many of OAuth 1.0’s more confusing and problem-prone

aspects, such as its custom signature calculation mechanism. After much debate in the

community, WRAP was decided on as the basis for the new OAuth 2.0 protocol. Where

OAuth 1.0 was monolithic, OAuth 2.0 was modular. The modularity in OAuth 2.0

allowed it to be a framework that could be deployed and used in all of the ways that

OAuth 1.0 had been in practice, but without twisting core aspects of the protocol.

OAuth 2.0 essentially provided recipes.

In 2012, the core OAuth 2.0 specifications were ratified by the IETF, but the com-

munity was far from done with it. This modularity was further codified by splitting the

specification into two complementary pieces: RFC 6749 details how to get a token,

while RFC 6750 details how to use a particular type of token (the Bearer token) at a

protected resource. Furthermore, the core of RFC6749 details multiple ways to get a

token and provides an extension mechanism. Instead of defining one complex method

to fit different deployment models, OAuth 2.0 defines four different grant types, each

suited to a different application type.

Today, OAuth 2.0 is the premier authorization protocol in use on the web. It’s used

by everything: from large internet companies to small startups, to enterprises, to just

about everything in between and beyond. A whole ecosystem of extensions, profiles,

and entire protocols built on top of OAuth 2.0 has sprung up, with people finding new

and interesting ways to use this foundational technology. It’s our goal that this book

will help you understand not only what OAuth 2.0 is and why it works the way it does,

but how you can best use it to solve your own problems and build your own systems.

JUSTIN RICHER

xviii acknowledgments

chance and preordered the book as a MEAP; the early feedback we got from you was

vital in making this the best book we could make it.

We would also like to thank our peer reviewers who read the manuscript at various

stages of its development and provided invaluable feedback along the way: Alessandro

Campeis, Darko Bozhinovski, Gianluigi Spagnuolo, Gregor Zurowski, John Guthrie,

Jorge Bo, Richard Meinsen, Thomas O’Rourke, and Travis Nelson.

Justin Richer

Incomparable thanks are due to my coauthor, Antonio Sanso. His security and crypto-

graphic expertise far outstrips anything I could dream of achieving, and it’s been an

honor to work with him. Starting the book was his idea in the first place, and the whole

project has been a collaborative effort.

Thanks to my friends Mark Sherman and Dave Shepherd, both of whom success-

fully published tech books before I first set words to the page. Their existence served

to remind me that there was a light at the end of the tunnel, and their experience

in navigating the publishing world was a great help. Thanks to John Brooks, Tristan

Lewis, and Steve Moore, whom I was able to bounce ideas and phrases off of, even if

they didn’t always realize I was doing it at the time.

Many thanks to my clients over the last year for putting up with me disappearing at

random times to go off and write. Thanks are especially due to Debbie Bucci and Paul

Grassi, as their fantastic work programs have helped give me the direct experience

needed to ground this book in the real world.

I can’t possibly express enough thanks to my friend and colleague, Sarah Squire. She

originally turned me on to the Node.js frameworks used in the exercises throughout

the book, and I believe that, thanks to a trip to an office store, she has the distinction

of owning the first printed version of this book. Overall, her encouragement, support,

critique, and enthusiasm for this project has been without compare, and I doubt that

the book would have really happened without her.

Finally, but perhaps most importantly, a sincere and deep thank you to my entire

family. The patience of my wife, Debbie, and my kids, Lucien, Genevieve, and Xavier,

has been incredible. Between late nights and seemingly endless weekends with me

locked up in my office, just out of reach, I’m sure they started to wonder if I’d ever

come out, but now I’m glad to say there should be a whole lot more time to play Legos.

Antonio Sanso

Working on this book has been quite a ride, and it’s with great delight and satisfaction

that I write this part. In the end, as with everything, it’s the journey and not the destina-

tion that matters. My contribution to this book could not be possible without the help

of many people surrounding me.

I would like to thank my employer, Adobe Systems, and my managers Michael Marth

and Philipp Suter for giving me the green light to work on this book.

剩余361页未读，继续阅读

i_fisher

粉丝: 2
资源: 42

OAuth 2 实战：客户端与服务器端的应用与安全实践

OAuth2资源集合(Oauth2 in Action,OAuth2.0 Cookbook,Getting Started with OAuth 2.0)

Spring Boot 2中的安全控制与OAuth 2.0

oauth2 +spring

oauth2authorizationserverjackson2module作用

springboot 整合oauth2

springboot oauth2 client

java实现oauth2 客户端

java实现oauth2

Koa2 oauth2

spring-security-oauth2 和spring-cloud-starter-oauth2

最新资源