OAuth 2.0简单实战（以新浪开发平台为例）

ymyang 发布于2019-07-24 17:43 / 3225人阅读

摘要：背景本人去年在打酱油的时候曾经要求抓过新浪微博的有关数据。然而要读写这些微博信息和朋友关系，必须要在新浪围脖平台上注册应用。

背景

本人去年在UCLA打酱油的时候曾经要求抓过新浪微博的有关数据。然而要读写这些微博信息和朋友关系，必须要在新浪围脖平台上注册应用。也就是要接触 OAuth 2.0 这个东西。当时基本不懂，今天看到了阮一峰博客上的这篇文章,决定自己动手一试。

准备

首先，你要把阮一峰博客上的这篇文章粗略的读一遍。

然后你要上新浪开发平台注册一个应用，我注册的是微连接 - 网页应用

打开界面你可以看到App Key和App Secret，这是要用的东西

好，接下来下载新浪微博python SDK，我们用Python进行分析

分析

首先，我们先根据微博API上面的HOW-TO 文档上来做

</>复制代码 
from weibo import APIClient
APP_KEY = "1234567" # app key
APP_SECRET = "abcdefghijklmn" # app secret
CALLBACK_URL = "http://www.example.com/callback" 
client = APIClient(app_key=APP_KEY, app_secret=APP_SECRET, redirect_uri=CALLBACK_URL)
url = client.get_authorize_url()

这样就拿到了URL了，你打开这个URL一看，正是提示你要授权应用（出现error:redirect_uri_mismatch 同学请到新浪微博开发界面填好redirect_uri)

好，我们看看源码

</>复制代码 
class APIClient(object):
    """
    API client using synchronized invocation.
    """
    def __init__(self, app_key, app_secret, redirect_uri=None, response_type="code", domain="api.weibo.com", version="2"):
        self.client_id = str(app_key)
        self.client_secret = str(app_secret)
        self.redirect_uri = redirect_uri
        self.response_type = response_type
        self.auth_url = "https://%s/oauth2/" % domain
        self.api_url = "https://%s/%s/" % (domain, version)
        self.access_token = None
        self.expires = 0.0
        self.get = HttpObject(self, _HTTP_GET)
        self.post = HttpObject(self, _HTTP_POST)
        self.upload = HttpObject(self, _HTTP_UPLOAD)
    def get_authorize_url(self, redirect_uri=None, **kw):
        """
        return the authorization url that the user should be redirected to.
        """
        redirect = redirect_uri if redirect_uri else self.redirect_uri
        if not redirect:
            raise APIError("21305", "Parameter absent: redirect_uri", "OAuth2 request")
        response_type = kw.pop("response_type", "code")
        return "%s%s?%s" % (self.auth_url, "authorize", 
                _encode_params(client_id = self.client_id, 
                        response_type = response_type, 
                        redirect_uri = redirect, **kw))

client_id,redirect_url,app_key，好熟悉啊，仔细一看，原来是授权码模式的第一步

</>复制代码 
  The client constructs the request URI by adding the following
  parameters to the query component of the authorization endpoint URI
  using the "application/x-www-form-urlencoded" format, per Appendix B:
  
  response_type
           REQUIRED.  Value MUST be set to "code".
  
  client_id
           REQUIRED.  The client identifier as described in Section 2.2.
  
  redirect_uri
           OPTIONAL.  As described in Section 3.1.2.
  
  scope
           OPTIONAL.  The scope of the access request as described by
           Section 3.3.
  
  state
           RECOMMENDED.  An opaque value used by the client to maintain
           state between the request and callback.  The authorization
           server includes this value when redirecting the user-agent back
           to the client.  The parameter SHOULD be used for preventing
           cross-site request forgery as described in Section 10.12.

好了，当我们把账号密码填写好了之后验证成功后，你发现你的浏览器上面的URL发生了变化，到底是这么回事呢，请看第二步Authorization Response

</>复制代码 
  If the resource owner grants the access request, the authorization
  server issues an authorization code and delivers it to the client by
  adding the following parameters to the query component of the
  redirection URI using the "application/x-www-form-urlencoded" format,
  per Appendix B:
  
  code
           REQUIRED.  The authorization code generated by the
           authorization server.  The authorization code MUST expire
           shortly after it is issued to mitigate the risk of leaks.  A
           maximum authorization code lifetime of 10 minutes is
           RECOMMENDED.  The client MUST NOT use the authorization code more than once.  If an authorization code is used more than
           once, the authorization server MUST deny the request and SHOULD
           revoke (when possible) all tokens previously issued based on
           that authorization code.  The authorization code is bound to
           the client identifier and redirection URI.
  
  state
           REQUIRED if the "state" parameter was present in the client
           authorization request.  The exact value received from the
           client.
  
  For example, the authorization server redirects the user-agent by
  sending the following HTTP response:

</>复制代码 
 HTTP/1.1 302 Found
 Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
           &state=xyz

然后我们继续按照API的指示做

</>复制代码 
# 获取URL参数code:
code = your.web.framework.request.get("code")
r = client.request_access_token(code)
def request_access_token(self, code, redirect_uri=None):
        redirect = redirect_uri if redirect_uri else self.redirect_uri
        if not redirect:
            raise APIError("21305", "Parameter absent: redirect_uri", "OAuth2 request")
        r = _http_post("%s%s" % (self.auth_url, "access_token"), 
                client_id = self.client_id, 
                client_secret = self.client_secret, 
                redirect_uri = redirect, 
                code = code, grant_type = "authorization_code")
        return self._parse_access_token(r)

这个获得code 方法通常可以有很多，但是我们既然是实验，就手动复制code 吧。

哈哈，很明显request_access_token 这个方法就是发一个HTTP POST 包嘛

第三步Access Token Request

</>复制代码 
  The client makes a request to the token endpoint by sending the
  following parameters using the "application/x-www-form-urlencoded"
  format per Appendix B with a character encoding of UTF-8 in the HTTP
  request entity-body:
  
  grant_type
           REQUIRED.  Value MUST be set to "authorization_code".
  
  code
           REQUIRED.  The authorization code received from the
           authorization server.
  
  redirect_uri
           REQUIRED, if the "redirect_uri" parameter was included in the
           authorization request as described in Section 4.1.1, and their
           values MUST be identical.
  
  client_id
           REQUIRED, if the client is not authenticating with the
           authorization server as described in Section 3.2.1.
  
  If the client type is confidential or the client was issued client
  credentials (or assigned other authentication requirements), the
  client MUST authenticate with the authorization server as described
  in Section 3.2.1.
  
  For example, the client makes the following HTTP request using TLS
  (with extra line breaks for display purposes only):
</>复制代码 
 POST /token HTTP/1.1
 Host: server.example.com
 Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
 Content-Type: application/x-www-form-urlencoded
 grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA
 &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb

最后一步

</>复制代码 
access_token = r.access_token # 新浪返回的token，类似abc123xyz456
expires_in = r.expires_in # token过期的UNIX时间：http://zh.wikipedia.org/wiki/UNIX%E6%97%B6%E9%97%B4
# TODO: 在此可保存access token
client.set_access_token(access_token, expires_in)

就是从服务器返回的HTTP 包中解析access_token 和 expire_in 数据

同样来看RFC 文档中写的

</>复制代码 
  If the access token request is valid and authorized, the
  authorization server issues an access token and optional refresh
  token as described in Section 5.1.  If the request client
  authentication failed or is invalid, the authorization server returns
  an error response as described in Section 5.2.
  
  An example successful response:
</>复制代码 
 HTTP/1.1 200 OK
 Content-Type: application/json;charset=UTF-8
 Cache-Control: no-store
 Pragma: no-cache
 {
   "access_token":"2YotnFZFEjr1zCsicMWpAA",
   "token_type":"example",
   "expires_in":3600,
   "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
   "example_parameter":"example_value"
 }

接下来就可以调用API啦~

对于最后两步看的很累的话，可以自己尝试写一个

</>复制代码 
import urllib, urllib2
APP_KEY = "2613134348"
APP_SECRET = "5a14f41598a7444c7e0dc0422519b091" # app secret
ACCESS_TOKEN = "9cd1b3869e62491331caf444456953e8"
data = {
        "grant_type" : "authorization_code", 
        "code" :ACCESS_TOKEN, 
        "redirect_uri":"http://www.ceclinux.org",
        "client_id":APP_KEY,
        "client_secret":APP_SECRET   
        }
headers = {"host":"api.weibo.com","Authorization":"OAuth2 %s" % ACCESS_TOKEN}
data = urllib.urlencode(data)
request = urllib2.Request("https://api.weibo.com/oauth2/access_token", data, headers)
response = urllib2.urlopen(request)
print response.read()

运行这个文件
最后也能得到一个包含access_token和expire_date的JSON文件

没了～

参考

http://github.liaoxuefeng.com/sinaweibopy/

https://github.com/michaelliao/sinaweibopy/wiki/OAuth2-HOWTO

http://www.ruanyifeng.com/blog/2014/05/oauth_2_0.html

GPU云服务器云服务器实战开发前端实战开发前端开发实战 spark实战开发

文章版权归作者所有，未经允许请勿转载,若此文章存在违规行为，您可以联系管理员删除。

转载请注明本文地址：https://www.ucloud.cn/yun/37402.html

OAuth 2.0协议在SAP产品中的应用

摘要：阮一峰老师曾经在他的博文理解里对这个概念有了深入浅出的阐述。注这是阮一峰老师文章里提到的中的认证模式之一简化模式客户听起来不错这样我就不需要把我们公司的用户的密码提供给您了。这下您放心了吧注这种方式即阮一峰文章里介绍的授权码模式。阮一峰老师曾经在他的博文理解OAuth 2.0里对这个概念有了深入浅出的阐述。 http://www.ruanyifeng.com/blo... 本文会结合...

qiangdada 2019-08-16 11:03 评论0 收藏0
OAuth 2.0协议在SAP产品中的应用

摘要：阮一峰老师曾经在他的博文理解里对这个概念有了深入浅出的阐述。注这是阮一峰老师文章里提到的中的认证模式之一简化模式客户听起来不错这样我就不需要把我们公司的用户的密码提供给您了。这下您放心了吧注这种方式即阮一峰文章里介绍的授权码模式。阮一峰老师曾经在他的博文理解OAuth 2.0里对这个概念有了深入浅出的阐述。 http://www.ruanyifeng.com/blo... 本文会结合...

princekin 2019-08-26 11:43 评论0 收藏0
利用新浪API实现数据的抓取微博数据爬取微博爬虫

摘要：本人长期出售超大量微博数据旅游网站评论数据，并提供各种指定数据爬取服务，。如果用户传入伪造的，则新浪微博会返回一个错误。 PS:(本人长期出售超大量微博数据、旅游网站评论数据，并提供各种指定数据爬取服务，Message to YuboonaZhang@Yahoo.com。由于微博接口更新后限制增大，这个代码已经不能用来爬数据了。如果只是为了收集数据可以咨询我的邮箱，如果是为了学习爬虫，...

liuyix 2019-07-30 15:12 评论0 收藏0

发表评论

登陆后可评论

0条评论

ymyang

男|高级讲师

我要关注我要私信

TA的文章

tensorrt

阅读 2856·2023-04-25 22:51
基于RabbitMQ的MQTT插件搭建MQTT服务，使用MQTTX进行收发测试

阅读 2183·2021-10-11 10:58
react-鼠标滑过显示编辑按钮点击显示输入框编辑内容

阅读 3360·2019-08-30 10:49
详解css媒体查询

阅读 1923·2019-08-29 17:09
Flex 布局教程：语法篇

阅读 3177·2019-08-29 10:55
js对象拷贝

阅读 882·2019-08-26 10:34
等高布局常用几种方式

阅读 3592·2019-08-23 17:54
Web打印探秘

阅读 1028·2019-08-23 16:06

资讯专栏INFORMATION COLUMN

上云采购季！| 2核2G4M爆款云服务器低至59元/年，更有多台、长期优惠，快来选购！

OAuth 2.0简单实战（以新浪开发平台为例）

</>复制代码

</>复制代码

</>复制代码

</>复制代码

</>复制代码

</>复制代码

</>复制代码

`</>复制代码`

</>复制代码

</>复制代码

`</>复制代码`

</>复制代码

相关文章

OAuth 2.0协议在SAP产品中的应用

OAuth 2.0协议在SAP产品中的应用

利用新浪API实现数据的抓取微博数据爬取微博爬虫

发表评论

0条评论

ymyang

男|高级讲师

TA的文章

tensorrt

基于RabbitMQ的MQTT插件搭建MQTT服务，使用MQTTX进行收发测试

react-鼠标滑过显示编辑按钮点击显示输入框编辑内容

详解css媒体查询

Flex 布局教程：语法篇

js对象拷贝

等高布局常用几种方式

Web打印探秘

最新活动