Spring security real combat dry goods: initial experience of oauth2 third party authorization

Little fat brother manong 2020-11-09 10:49:41
spring security real combat dry

1. Preface

Spring Security Combat dry series

Now many projects have the need of third party login or third party authorization , And the most mature solution is OAuth2.0 License agreement .Spring Security It's also integrated OAuth2.0, In the latest Spring Security 5 The integration of OAuth2.0 The client of , We can use it conveniently Spring Security OAuth2 To achieve the relevant requirements .

Next, follow Pangge's rhythm to make a third-party authorization. Let's have an intuitive experience first . Suppose I don't know now OAuth2.0 Starting from scratch , The product gives a need to use code cloud for authorization , How can we achieve it ?

2. Apply for authorization

It's like you want to work for a company , You have to interview and submit a lot of materials to prove that you can meet the needs of the other party , After approval, the company allows you to go to work , Give you a position and corresponding authority 、 Job number 、 Workstation .

Same thing , We're going to code cloud to apply for an authorization function , That is to open a credit client on the other party's open platform . In the future, whether you are wechat 、 Alipay or QQ It's the same process . When the application is successful, they will give you the following field concepts .

Depending on the platform, the concept of field may be slightly different , But not too big .

2.1 clientId

A very long string , This is the platform of your application “ Job number ”, Carry this when you ask for authorization clientId As a logo for your app .

2.2 clientSecret

Client key , It's like a password to prove that your authorization request actually came from your app . This is sensitive data , Be careful of confidentiality .

2.3 authorizationGrantType

The type of authorization approach , You will be able to tell the third party when you apply for the type of authorization . When you request authorization, you need to clearly tell the third-party platform your authorization type .

OAuth2.0 It provides four common ways and two other ways that are not commonly used .

2.4 tokenUri

This is a third-party open platform for you to access access_token The interface of , This access_token It's your credentials for accessing open resources on third-party open platforms .

2.5 userInfoUri

This is the interface you use to get the user information of the authorized person on the third party open platform , Most of them are sensitive information that public information doesn't cover , In order to achieve the purpose of information sharing between different platforms .

2.6 redirectUri

token url , Some platforms are called callback. What's the use ? It's like the mobile phone or email you left for the interview , After the interview, the interviewer told you to go back and wait for the interview result . This redirectUri It is used to inform you of the result of authorization , Of course, this is more reliable than the interviewer , Chengdu will tell you the result .

Of course, the interview example here is not particularly appropriate , It's just easy for you to quickly understand .

2.7 scope

This is the authorization entry , It means that you want to show what you want this authorization to do , A company sent a lot of JD Yes Java Development 、Golang Development 、 The front-end development 、 test 、UI. When you go to an interview, the first thing you should do is to tell the interviewer which position you are interviewing for is the same .

Of course about OAuth2.0 Of scope It may be more abundant .

3. Experience OAuth2.0 to grant authorization

Learn to touch a new thing without understanding it , First, feel it intuitively , Understand how it works on the surface , And then go into it .

So I just let it go first Spring Security OAuth2.0 Third party authorized code cloud DEMO, Interested students first intuitively feel the scene , In the future, I will learn this technology from the simple to the deep .

3.1 Usage method

Official account : Small fat man of minong reply authgitee obtain Spring Security OAuth2.0 DEMO after , Direct operation Corresponding branch project . Then browser access interface .http://localhost:8082/oauth2/authorization/gitee Experience . lock : Small fat man of minong The mechanism will be analyzed in detail later .

Official account :Felordcn Get more information

Personal blog :https://felord.cn

本文为[Little fat brother manong]所创,转载请带上原文链接,感谢

  1. 【计算机网络 12(1),尚学堂马士兵Java视频教程
  2. 【程序猿历程,史上最全的Java面试题集锦在这里
  3. 【程序猿历程(1),Javaweb视频教程百度云
  4. Notes on MySQL 45 lectures (1-7)
  5. [computer network 12 (1), Shang Xuetang Ma soldier java video tutorial
  6. The most complete collection of Java interview questions in history is here
  7. [process of program ape (1), JavaWeb video tutorial, baidu cloud
  8. Notes on MySQL 45 lectures (1-7)
  9. 精进 Spring Boot 03:Spring Boot 的配置文件和配置管理,以及用三种方式读取配置文件
  10. Refined spring boot 03: spring boot configuration files and configuration management, and reading configuration files in three ways
  11. 精进 Spring Boot 03:Spring Boot 的配置文件和配置管理,以及用三种方式读取配置文件
  12. Refined spring boot 03: spring boot configuration files and configuration management, and reading configuration files in three ways
  13. 【递归,Java传智播客笔记
  14. [recursion, Java intelligence podcast notes
  15. [adhere to painting for 386 days] the beginning of spring of 24 solar terms
  16. K8S系列第八篇(Service、EndPoints以及高可用kubeadm部署)
  17. K8s Series Part 8 (service, endpoints and high availability kubeadm deployment)
  18. 【重识 HTML (3),350道Java面试真题分享
  19. 【重识 HTML (2),Java并发编程必会的多线程你竟然还不会
  20. 【重识 HTML (1),二本Java小菜鸟4面字节跳动被秒成渣渣
  21. [re recognize HTML (3) and share 350 real Java interview questions
  22. [re recognize HTML (2). Multithreading is a must for Java Concurrent Programming. How dare you not
  23. [re recognize HTML (1), two Java rookies' 4-sided bytes beat and become slag in seconds
  24. 造轮子系列之RPC 1:如何从零开始开发RPC框架
  25. RPC 1: how to develop RPC framework from scratch
  26. 造轮子系列之RPC 1:如何从零开始开发RPC框架
  27. RPC 1: how to develop RPC framework from scratch
  28. 一次性捋清楚吧,对乱糟糟的,Spring事务扩展机制
  29. 一文彻底弄懂如何选择抽象类还是接口,连续四年百度Java岗必问面试题
  30. Redis常用命令
  31. 一双拖鞋引发的血案,狂神说Java系列笔记
  32. 一、mysql基础安装
  33. 一位程序员的独白:尽管我一生坎坷,Java框架面试基础
  34. Clear it all at once. For the messy, spring transaction extension mechanism
  35. A thorough understanding of how to choose abstract classes or interfaces, baidu Java post must ask interview questions for four consecutive years
  36. Redis common commands
  37. A pair of slippers triggered the murder, crazy God said java series notes
  38. 1、 MySQL basic installation
  39. Monologue of a programmer: despite my ups and downs in my life, Java framework is the foundation of interview
  40. 【大厂面试】三面三问Spring循环依赖,请一定要把这篇看完(建议收藏)
  41. 一线互联网企业中,springboot入门项目
  42. 一篇文带你入门SSM框架Spring开发,帮你快速拿Offer
  43. 【面试资料】Java全集、微服务、大数据、数据结构与算法、机器学习知识最全总结,283页pdf
  44. 【leetcode刷题】24.数组中重复的数字——Java版
  45. 【leetcode刷题】23.对称二叉树——Java版
  46. 【leetcode刷题】22.二叉树的中序遍历——Java版
  47. 【leetcode刷题】21.三数之和——Java版
  48. 【leetcode刷题】20.最长回文子串——Java版
  49. 【leetcode刷题】19.回文链表——Java版
  50. 【leetcode刷题】18.反转链表——Java版
  51. 【leetcode刷题】17.相交链表——Java&python版
  52. 【leetcode刷题】16.环形链表——Java版
  53. 【leetcode刷题】15.汉明距离——Java版
  54. 【leetcode刷题】14.找到所有数组中消失的数字——Java版
  55. 【leetcode刷题】13.比特位计数——Java版
  56. oracle控制用户权限命令
  57. 三年Java开发,继阿里,鲁班二期Java架构师
  58. Oracle必须要启动的服务
  59. 万字长文!深入剖析HashMap,Java基础笔试题大全带答案
  60. 一问Kafka就心慌?我却凭着这份,图灵学院vip课程百度云