认证相关的点滴积累

跨域访问及认证相关

跨域常用的一些配置标签

• Access-Control-Allow-Origin:必须的，它的值是请求时Origin字段的值或者 *，表示接受任意域名的请求.比如:”*”或者”dashboard.yomob.com”
• Access-Control-Allow-Credentials:可选,表示是否允许发送Cookie到服务器.比如:”true”
• Access-Control-Allow-Methods:必需，它的值是逗号分隔的一个字符串，表明服务器支持的所有跨域请求的方法。注意，返回的是所有支持的方法，而不单是浏览器请求的那个方法。这是为了避免多次”预检”请求.比如:”POST, PUT, GET, OPTIONS, DELETE”
• Access-Control-Allow-Headers:如果浏览器请求包括Access-Control-Request-Headers字段，则Access-Control-Allow-Headers字段是必需的。它也是一个逗号分隔的字符串，表明服务器支持的所有头信息字段，不限于浏览器在”预检”中请求的字段.比如:”x-requested-with, Authorization, Content-Type”
• Access-Control-Max-Age:该字段可选，用来指定本次预检请求的有效期，单位为秒。上面结果中，有效期是20天（1728000秒），即允许缓存该条回应1728000秒（即20天），在此期间，不用发出另一条预检请求.比如:”3600”

跨域资源共享

• W3C出了一个标准－CORS－”跨域资源共享”（Cross-origin resource sharing）,它允许浏览器向跨源服务器，发出XMLHttpRequest请求，从而克服了AJAX只能同源使用的限制.
• 首先来说 CORS 需要浏览器和服务端同时支持的，对于兼容性来说主要是ie10+，其它现代浏览器都是支持的.
• 使用 CORS 跨域的时候其实和普通的 ajax 过程是一样的，只是浏览器在发现这是一个跨域请求的时候会自动帮我们处理一些事，比如验证等等，所以说只要服务端提供支持，前端是不需要做额外的事情的.

OAuth2.0 使用的是 access_token

获取access_token 接口

• Request URL:

{
https://dashboard.test.yomob.com/api/oauth/token
}

• RequestHeaders:

  1. Authorization:
     “`
     {
     Basic ZGFzaGJvYXJkOnNlY3JldA==
     }

2.  Cookie:

{
Hm_lvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424949; Hm_lpvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424950; __lc.visitor_id.9064240=S1506424971.60e59c5a89; autoinvite_callback=true; lc_window_state=minimized; __lc.visitor_id.9168725=S1507805381.02ca34025c; lc_window_state=full; hide_eye_catcher=1; lc_window_state=minimized; Hm_lvt_f95e3d3ce2ae407694d07849c428517c=1507775851; Hm_lpvt_f95e3d3ce2ae407694d07849c428517c=1508313189
}

 3. Form Data 
 ```
{
grant_type=password&username=admin@ziwen.com&password=10101010
}

• response:

{
    "access_token": "5b20f67c-733b-4d66-80c6-97836f524601",
    "token_type": "bearer",
    "refresh_token": "681a239c-0681-4d3c-b860-0dd60b064f47",
    "expires_in": 848,
    "scope": "read write"
}

普通的业务接口

• Request URL:

{
https://csdn.test.yomob.com/api/accounts/me
}

• RequestHeaders:
  
  1. Authorization:

{
Bearer 5b20f67c-733b-4d66-80c6-97836f524601
}

1. Cookie:

{
Hm_lvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424949; Hm_lpvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424950; __lc.visitor_id.9064240=S1506424971.60e59c5a89; autoinvite_callback=true; lc_window_state=minimized; __lc.visitor_id.9168725=S1507805381.02ca34025c; lc_window_state=full; hide_eye_catcher=1; lc_window_state=minimized; Hm_lvt_f95e3d3ce2ae407694d07849c428517c=1507775851; Hm_lpvt_f95e3d3ce2ae407694d07849c428517c=1508313189

}

JWT 使用的是:token

获取token的接口

Request URL:https://astemp.yomob.com/api/auth/access_token
RequestHeaders:
- Cookie: Hm_lvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424949; Hm_lpvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424950; __lc.visitor_id.9064240=S1506424971.60e59c5a89; autoinvite_callback=true; lc_window_state=minimized
- Request Payload:

{
  "loginName": "admin@ziwen.com",
  "loginPass": "101010101"
}

response:

{
"token": "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBzb3VsZ2FtZS5jb20iLCJjcmVhdGVkIjoxNTA4MzE1NDg2MDQ0LCJleHAiOjE1MDg0MDE4ODYsImF1dGhvcml0aWVzIjpbeyJhdXRob3JpdHkiOiJST0xFX1VTRVIifSx7ImF1dGhvcml0eSI6IlJPTEVfQURNSU4ifV19.i2AnEtEd6bvTlUepUprX4ZQbiEsnUkkmKFbpe13KBSzdTZj6K0BgWnSp-GRNJUSNAQmyk61vHPmovPQOUg5b8g"
}

普通的业务接口

• Request URL:

{
https://abc.yomob.com/api/me
}

• RequestHeaders:
  
  1. Cookie:

{
 Hm_lvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424949; Hm_lpvt_b3dc15336bfd7f500d18213a1e6aa1f6=1506424950; __lc.visitor_id.9064240=S1506424971.60e59c5a89; autoinvite_callback=true; lc_window_state=minimized
}

1. Authorization:

{
Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBzb3VsZ2FtZS5jb20iLCJjcmVhdGVkIjoxNTA4MzE1NDg2MDQ0LCJleHAiOjE1MDg0MDE4ODYsImF1dGhvcml0aWVzIjpbeyJhdXRob3JpdHkiOiJST0xFX1VTRVIifSx7ImF1dGhvcml0eSI6IlJPTEVfQURNSU4ifV19.i2AnEtEd6bvTlUepUprX4ZQbiEsnUkkmKFbpe13KBSzdTZj6K0BgWnSp-GRNJUSNAQmyk61vHPmovPQOUg5b8g
}

postman 中访问

获取access_token 的接口

1. URL 为:

{
 http://localhost:9000/oauth/token?grant_type=password&username=admin@ziwen.com&password=101010
}

1. 它的Headers为:

{
    Content-Type:application/json
    Authorization:Basic ZGFzaGJvYXJkOnNlY3JldA==
}

1. 得到的 Body为:

{
    "access_token": "cf6adc3d-d1cb-4bc6-b0f5-215bf7d3cf08",
    "token_type": "bearer",
    "refresh_token": "31ab013a-e9dd-4bb9-a787-7df1cbfd0b0e",
    "expires_in": 3584,
    "scope": "read write"
}

普通业务接口

• URL:

{
http://localhost:9000/reports/revenues?startDate=2017-10-11&endDate=2017-10-12
}

• 它的Headers为:

{
Content-Type:application/json
Authorization:bearer 8bbcd5a0-2ab6-44ce-86b0-c1898bb5872e  (tips:这个是 access_token)
}