Oauth2.0 入門

定義：Oauth協議容許第三方網站app在用戶受權後訪問你的站點的用戶的資源

角色：

resource owner 資源擁有者

An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user.

resource server 資源服務器

The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens.

client 客戶端

An application making protected resource requests on behalf of the resource owner and with its authorization. The term "client" does not imply any particular implementation characteristics (e.g., whether the application executes on a server, a desktop, or other devices).

authorization server 受權服務器

The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

流程：

1.跳轉到受權服務器端受權連接，如用戶未登陸則登陸，如已登陸，則受權第三方應用得到受權碼auth_code，auth_code臨時生成且生存時間很短，在換取access_token後即無效

2.跳轉到第三方回調url,帶上受權碼auth_code

3.第三方應用經過你的sdk或者本身調用api從受權服務器得到資源訪問的密鑰access_token，同時刪除auth_code，access_token也有過時時間，根據應用類型設置過時時間長短

4.refresh_token能夠在access_token過時後換取新的access_token

5.使用access_token從資源服務器調用受保護的資源