oauth - Oauth 刷新令牌

Question

对不起新手问题。如果无论如何我都必须发送我的凭据，那么刷新令牌有什么意义？

或者换句话说，请求刷新令牌或只是一个新的访问令牌之间的实际区别是什么？

这是我的代码：

    TokenResponse tokenResponse = null;
var tokenRequest = new TokenRequest
    {
        GrantType = "customgrant",
        ClientId = "myUserName",
        ClientSecret = "secret",
        Address = disco.TokenEndpoint,
    };

tokenResponse = await client.RequestTokenAsync(tokenRequest);

var testClient = new HttpClient();

testClient.SetBearerToken(tokenResponse.AccessToken);

var apiRes = await testClient.GetAsync("http://localhost:11000/api/GetData/104246");
if (!apiRes.IsSuccessStatusCode)
{

    if (apiRes.StatusCode == System.Net.HttpStatusCode.Unauthorized)
    {

        RefreshTokenRequest refreshTokenRequest = new RefreshTokenRequest();
        refreshTokenRequest.RefreshToken = tokenResponse.RefreshToken;
        refreshTokenRequest.ClientId = "myUserName";
        refreshTokenRequest.ClientSecret = "secret";
        refreshTokenRequest.Address = disco.TokenEndpoint;
        tokenResponse = await testClient.RequestRefreshTokenAsync(refreshTokenRequest);
    }
}

标签： oauthoauth-2.0asp.net-identityidentityserver4openid-connect

Answer 1

你的问题不清楚。refresh token当您已经拥有 valid 时，用于获取新的 validaccess token并且您不需要用户凭据refresh token。