有点料
English

OAuth 2.0 · OpenID Connect

Open platform

An application on another domain can sign in with this brand account using the authorization code flow. Each brand host is a separate account system.

Issuer https://jingweihome.com

Developer center

My applications

Add an application name and an https callback. Applications with a server receive a client_secret shown once.

Steps

  1. Sign in on this page and register the application name and https callback. Save the client_id. Confidential applications also save the client_secret, which is shown once.
  2. Send the browser to the authorization endpoint with a PKCE code_challenge.
  3. After account sign-in and consent on the brand host, the browser returns to your callback with a one-time code and your original state.
  4. Your server exchanges the code, code_verifier and client_secret for an access token, refresh token and id_token.
  5. Create the session on your own domain. User info always includes the username, and includes email only when the email scope was granted and the account has one. Revoke the token on logout.

Endpoints

Discovery
https://jingweihome.com/.well-known/openid-configuration
Authorize
GET https://jingweihome.com/api/public/oauth/authorize
Token
POST https://jingweihome.com/api/public/oauth/token
UserInfo
GET https://jingweihome.com/api/public/oauth/userinfo
Revoke
POST https://jingweihome.com/api/public/oauth/revoke
JWKS
GET https://jingweihome.com/api/public/oauth/jwks

Authorization parameters

  • response_type=code
  • client_id
  • redirect_uri must exactly match a registered https callback
  • scope=openid email openid is required; email adds the email claim
  • state
  • nonce
  • code_challenge = BASE64URL(SHA256(code_verifier))
  • code_challenge_method=S256

Token request

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=...&redirect_uri=...&client_id=...&client_secret=...&code_verifier=...

Public applications omit client_secret. Refresh with grant_type=refresh_token. The id_token is RS256. iss is the issuer above, aud is the client_id, and sub is the user id for this brand.

User info is only GET /api/public/oauth/userinfo, with Authorization: Bearer. It returns sub, username, preferred_username and name, plus email when that scope was granted and the account has one. The password is never included. Revocation posts token, client_id and client_secret.