适用于MVC的OAuth 2.0-RequestToken如何工作？

Question

I'm working with OAuth 2.0 for MVC, found here: http://community.codesmithtools.com/CodeSmith_Community/b/tdupont/archive/2011/03/18/oauth-2-0-for-mvc-two-legged-implementation.aspx

For anyone who's worked with this - I'm confused about the RequestToken. There is a controller implemented that lets you get a request token, which expires in 5 minutes, and you pass that token back in to get an AccessToken. But it never checks the request token for validity - it seems like you can pass in any access token you want to. What is the idea for the RequestToken here - are you supposed to create your own method of storing, referencing, and then deleting that token for those 5 minutes?

Thanks, Andy

Answer 1

This is all about how OAuth works in conjunction with your application Id, application secret key and valid domains for your application. Here is the process in general

1. Your application sends a request to the OAuth provider using your application Id and secret along with a callback (return Url).

2. The OAuth provider gets the request, checks your application Id and secret and validates that the callback url is from a domain that you have specified for your application.

   2a. If the callback url is not from a domain that you have specified, then the request is rejected with error.

   2b If the callback url is from your domain, it returns a temporary request key to your server.

3. Given that you received a request key, you send that back to the OAuth provider to get the actual access token for the user.

Now, as to why the request key step is in place, this is to prevent and help protect 'bad people' from attempting to use your application id to falsely authenticate other users. By sending the request token to you (a callback URL that you have approved), the OAuth provider has confidence that the request actually came from your servers.

You most certainly could send any string back instead of the request token, but you would quickly get an error back from the OAuth provider as that request token does not correspond to any existing authentication request from any known application.

Lastly, I am not clear on what you mean by 'validating the request token'? You did not generate the token not probably do not have insight into the algorithm to generate the request token. Given that, I am not sure how you would validate this. If you are concerned about validating the first step, take a look at the Facebook OAuth process. In there, they recommend sending a request key as part of your return Url(as a query string parameter). That request key will come back to your application which you could then use as a validation that, indeed, this is a response to a request that you made. How you store and track that request key is up to you (session, database). In the PHP samples, they use a 'state' variable to track a unique/arbitrary string: Facebook OAuth Server Side Login Example (in PHP)