Authorization Code Grant

👎複雑にして最強のフロー。

https://plantuml-proxy.vercel.app/svg/https://scrapbox.io/api/code/arai-ta/Authorization_Code_Grant/seq.uml#.svg

code:seq.uml

@startuml

box Client side

actor "Resource owner" as Owner

participant "User Agent" as UA

end box

box Server side

participant Client

participant "Authorization Server" as AuthZ

participant "Resource Server" as R

end box

activate Owner

Owner -> UA : Request

activate UA

UA -> Client : Request

activate Client

Client -> Client : リソース使いたいな〜

UA <- Client : Redirect to Authorization Server

deactivate Client

group OAuth Authorization Code Grant

UA -> AuthZ : GET /oauth/authorize

activate AuthZ

note over AuthZ: ログインしていなければ\nここでform認証を挟むことが多い

UA <- AuthZ : Show approval form

deactivate AuthZ

deactivate UA

Owner -> UA : 許可！

activate UA

UA -> AuthZ : POST /oauth/approve

activate AuthZ

UA <- AuthZ : codeどうぞ\nRedirect to callback \nLocation: /callback?code=code123...

deactivate AuthZ

note over UA

User Agentに帰ってくるのがAccess token「ではなく」

Authorization codeなのがImplicit Grantとの違い。

これはClientId, ClientSecretと一緒でないと引き替えられない。

end note

UA -> Client : codeどうぞ\nGET /callback?code=code123...

activate Client

Client -> AuthZ : POST /oatuh/token \n\

Authorization: Basic (clientId, clientSecret) \n\

code=code123...

activate AuthZ

Client <- AuthZ : access tokenどうぞ

deactivate AuthZ

end

Client -> R : GET /resource \nAuthorization: Bearer access token

activate R

Client <- R : リソースどうぞ

deactivate R

Client -> Client : リソースを使っていろいろできるぞ〜

UA <- Client : Response

deactivate Client

Owner <- UA : Response

deactivate UA

@enduml