OAuth 2.0 umožňuje aplikacím přístup k zdrojům uživatele bez sdílení hesla. Google Login, GitHub Login — to je OAuth.
Flows¶
- Authorization Code + PKCE: Web a mobile (doporučeno)
- Client Credentials: Machine-to-machine
- Device Authorization: TV, IoT
- Implicit (DEPRECATED): Nepoužívat
Authorization Code + PKCE¶
import hashlib, base64, secrets code_verifier = secrets.token_urlsafe(64) code_challenge = base64.urlsafe_b64encode( hashlib.sha256(code_verifier.encode()).digest() ).rstrip(b’=’).decode()
Exchange code for tokens¶
token = requests.post(“https://auth.example.com/token”, data={ “grant_type”: “authorization_code”, “code”: authorization_code, “client_id”: “myapp”, “code_verifier”: code_verifier, }).json()
Client Credentials¶
token = requests.post(“https://auth.example.com/token”, data={ “grant_type”: “client_credentials”, “client_id”: “service-a”, “client_secret”: “secret”, “scope”: “api.read”, }).json()
Key Takeaway¶
Auth Code + PKCE pro web/mobile, Client Credentials pro M2M. Vždy validujte state, krátká expirace tokenů.