OAuth 2.0 для API: полное руководство по аутентификации

// server.js
const express = require('express');
const axios = require('axios');
const app = express();

// Шаг 1: Редирект на авторизацию
app.get('/login', (req, res) => {
  const authUrl = `https://authorization-server.com/authorize?` +
    `client_id=${CLIENT_ID}&` +
    `redirect_uri=${encodeURIComponent('http://localhost:3000/callback')}&` +
    `response_type=code&` +
    `scope=read:user`;
  
  res.redirect(authUrl);
});

// Шаг 3-4: Callback и обмен кода на токен
app.get('/callback', async (req, res) => {
  const { code } = req.query;
  
  try {
    // Обмен authorization code на access token
    const tokenResponse = await axios.post('https://authorization-server.com/token', {
      grant_type: 'authorization_code',
      code: code,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      redirect_uri: 'http://localhost:3000/callback'
    });
    
    const { access_token, refresh_token, expires_in } = tokenResponse.data;
    
    // Сохраняем токены (в реальном приложении - в БД или сессии)
    req.session.access_token = access_token;
    req.session.refresh_token = refresh_token;
    
    res.redirect('/dashboard');
  } catch (error) {
    res.status(500).send('Ошибка авторизации');
  }
});

// Шаг 6: Использование access token
app.get('/api/user', async (req, res) => {
  const accessToken = req.session.access_token;
  
  try {
    const userResponse = await axios.get('https://api.example.com/user', {
      headers: {
        'Authorization': `Bearer ${accessToken}`
      }
    });
    
    res.json(userResponse.data);
  } catch (error) {
    res.status(401).send('Недействительный токен');
  }
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

# app.py
from flask import Flask, redirect, request, session
import requests

app = Flask(__name__)
app.secret_key = 'your-secret-key'

CLIENT_ID = 'your-client-id'
CLIENT_SECRET = 'your-client-secret'
REDIRECT_URI = 'http://localhost:5000/callback'

# Шаг 1: Редирект на авторизацию
@app.route('/login')
def login():
    auth_url = (
        f'https://authorization-server.com/authorize?'
        f'client_id={CLIENT_ID}&'
        f'redirect_uri={REDIRECT_URI}&'
        f'response_type=code&'
        f'scope=read:user'
    )
    return redirect(auth_url)

# Шаг 3-4: Callback и обмен кода на токен
@app.route('/callback')
def callback():
    code = request.args.get('code')
    
    # Обмен authorization code на access token
    token_data = {
        'grant_type': 'authorization_code',
        'code': code,
        'client_id': CLIENT_ID,
        'client_secret': CLIENT_SECRET,
        'redirect_uri': REDIRECT_URI
    }
    
    token_response = requests.post(
        'https://authorization-server.com/token',
        data=token_data
    )
    
    token_json = token_response.json()
    session['access_token'] = token_json['access_token']
    session['refresh_token'] = token_json['refresh_token']
    
    return redirect('/dashboard')

# Шаг 6: Использование access token
@app.route('/api/user')
def get_user():
    access_token = session.get('access_token')
    
    headers = {'Authorization': f'Bearer {access_token}'}
    user_response = requests.get(
        'https://api.example.com/user',
        headers=headers
    )
    
    return user_response.json()

if __name__ == '__main__':
    app.run(port=5000)

// client-credentials.js
const axios = require('axios');

async function getAccessToken() {
  try {
    const response = await axios.post('https://authorization-server.com/token', {
      grant_type: 'client_credentials',
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      scope: 'read:data write:data'
    }, {
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded'
      }
    });
    
    return response.data.access_token;
  } catch (error) {
    console.error('Ошибка получения токена:', error);
    throw error;
  }
}

async function callAPI() {
  const accessToken = await getAccessToken();
  
  const response = await axios.get('https://api.example.com/data', {
    headers: {
      'Authorization': `Bearer ${accessToken}`
    }
  });
  
  return response.data;
}

// Использование
callAPI()
  .then(data => console.log('Данные:', data))
  .catch(error => console.error('Ошибка:', error));

// refresh-token.js
const axios = require('axios');

async function refreshAccessToken(refreshToken) {
  try {
    const response = await axios.post('https://authorization-server.com/token', {
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET
    });
    
    return {
      access_token: response.data.access_token,
      refresh_token: response.data.refresh_token, // Новый refresh token
      expires_in: response.data.expires_in
    };
  } catch (error) {
    console.error('Ошибка обновления токена:', error);
    throw error;
  }
}

// Middleware для автоматического обновления токена
async function apiCallWithRefresh(url, accessToken, refreshToken) {
  try {
    const response = await axios.get(url, {
      headers: {
        'Authorization': `Bearer ${accessToken}`
      }
    });
    
    return response.data;
  } catch (error) {
    if (error.response && error.response.status === 401) {
      // Токен истек, обновляем
      const newTokens = await refreshAccessToken(refreshToken);
      
      // Повторяем запрос с новым токеном
      const retryResponse = await axios.get(url, {
        headers: {
          'Authorization': `Bearer ${newTokens.access_token}`
        }
      });
      
      return retryResponse.data;
    }
    
    throw error;
  }
}

// routes/api.php
Route::middleware('auth:api')->get('/user', function (Request $request) {
    return $request->user();
});

// Получение токена
Route::post('/oauth/token', function (Request $request) {
    $response = Http::asForm()->post('http://your-app.com/oauth/token', [
        'grant_type' => 'authorization_code',
        'client_id' => $request->client_id,
        'client_secret' => $request->client_secret,
        'redirect_uri' => $request->redirect_uri,
        'code' => $request->code,
    ]);
    
    return $response->json();
});

// Использование токена
Route::get('/api/data', function (Request $request) {
    $token = $request->bearerToken();
    
    $response = Http::withToken($token)->get('https://api.example.com/data');
    
    return $response->json();
});

// main.go
package main

import (
    "context"
    "fmt"
    "golang.org/x/oauth2"
    "golang.org/x/oauth2/clientcredentials"
)

func main() {
    // Client Credentials Flow
    config := &clientcredentials.Config{
        ClientID:     "your-client-id",
        ClientSecret: "your-client-secret",
        TokenURL:     "https://authorization-server.com/token",
        Scopes:       []string{"read:data"},
    }
    
    token, err := config.Token(context.Background())
    if err != nil {
        panic(err)
    }
    
    // Использование токена
    client := config.Client(context.Background())
    resp, err := client.Get("https://api.example.com/data")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()
    
    fmt.Println("Response:", resp.Status)
}

// Authorization Code Flow
func authorizationCodeFlow() {
    config := &oauth2.Config{
        ClientID:     "your-client-id",
        ClientSecret: "your-client-secret",
        RedirectURL:  "http://localhost:8080/callback",
        Scopes:       []string{"read:user"},
        Endpoint: oauth2.Endpoint{
            AuthURL:  "https://authorization-server.com/authorize",
            TokenURL: "https://authorization-server.com/token",
        },
    }
    
    // Шаг 1: Редирект на авторизацию
    url := config.AuthCodeURL("state", oauth2.AccessTypeOffline)
    fmt.Println("Visit:", url)
    
    // Шаг 4: Обмен кода на токен
    token, err := config.Exchange(context.Background(), "authorization-code")
    if err != nil {
        panic(err)
    }
    
    // Использование токена
    client := config.Client(context.Background(), token)
    resp, err := client.Get("https://api.example.com/user")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()
}

// pkce-example.js
const crypto = require('crypto');

// Генерация code_verifier и code_challenge
function generatePKCE() {
  // Генерируем случайную строку
  const codeVerifier = crypto.randomBytes(32).toString('base64url');
  
  // Создаем SHA256 hash
  const codeChallenge = crypto
    .createHash('sha256')
    .update(codeVerifier)
    .digest('base64url');
  
  return { codeVerifier, codeChallenge };
}

// Шаг 1: Редирект с code_challenge
const { codeVerifier, codeChallenge } = generatePKCE();
const authUrl = `https://authorization-server.com/authorize?` +
  `client_id=${CLIENT_ID}&` +
  `redirect_uri=${REDIRECT_URI}&` +
  `response_type=code&` +
  `code_challenge=${codeChallenge}&` +
  `code_challenge_method=S256`;

// Шаг 4: Обмен кода на токен с code_verifier
const tokenResponse = await axios.post('https://authorization-server.com/token', {
  grant_type: 'authorization_code',
  code: authorizationCode,
  client_id: CLIENT_ID,
  redirect_uri: REDIRECT_URI,
  code_verifier: codeVerifier // Отправляем оригинальный code_verifier
});