问题描述
我正在通过移动应用程序针对Instagram API发出请求.目前,我只是将用户定向到Instagram身份url,并将响应类型指定为"access_token".指定此response_type称为隐式身份验证.
I'm making requests against the Instagram API from a mobile app. Currently, I'm just directing the user to the Instagram auth url and specifying the response type to be "access_token". Specifying this response_type is known as implicit auth.
显式身份验证:response_type =代码隐式验证:response_type = access_token
Explicit auth: response_type=codeImplicit auth: response_type=access_token
我正试图解决需要站立一个Web服务来促进显式身份验证的问题.这是必要的,因为在显式身份验证流程中,Instagram API需要调用重定向URL并传递"code"参数.然后,我的服务器端代码将使用该代码向Instagram发出最终请求以获取访问令牌.
I'm trying to get around needing to stand up a web service to facilitate explicit auth. This would be necessary because in explicit auth flow, the Instagram API needs to make a call to a redirect URL and pass in a "code" parameter. The code would then be used by my server-side code to make a final request to Instagram for an access token.
移动应用程序使用隐式流的效率要高得多,因为不需要额外的私人维护的身份验证服务来处理它.
It's much more efficient for a mobile app to use implicit flow because no extra privately-maintained auth service needs to be stood up to handle it.
Instagram支持以下范围:
Instagram supports the following scopes:
- 基本-读取与用户相关的所有数据(例如跟随/跟随的列表,照片等)(默认情况下被授予)
- 评论-代表用户创建或删除评论
- 关系-代表用户关注和取消关注用户
- 喜欢-代表用户喜欢和喜欢的商品
- basic - to read any and all data related to a user (e.g.following/followed-by lists, photos, etc.) (granted by default)
- comments - to create or delete comments on a user’s behalf
- relationships - to follow and unfollow users on a user’s behalf
- likes - to like and unlike items on a user’s behalf
当我进行除基本"以外的任何其他类型的范围说明时,当用户在身份验证URL上提供凭据时,会收到以下响应:
When I make any other type of scope specification besides "basic", I get the following response when the user provides the credentials at the auth URL:
{"code": 400, "error_type": "OAuthException", "error_message": "Invalid scope field(s): basic+likes"}
除基本"范围外,任何范围的组合都将给出相同的响应.
Any combination of scopes other than "basic" gives the same response.
所以,我的问题是这些:
So, my question are these:
- 是否需要显式身份验证才能指定超出基本"范围的范围?
- 我是否需要指定response_type = code才能使扩展范围起作用?
- 这是Instagram的限制,还是OAuth 2.0的限制?
- Is explicit auth required in order to specify scopes beyond "basic"??
- Do I need to specify response_type=code in order for extended scopes to work?
- Is this an Instagram limitation, or is it a limitation of OAuth 2.0?
谢谢.
推荐答案
此处的答案是是,隐式身份验证流可以很好地请求范围.我的问题与我使用的OAuth组件有关.该组件正在对URL范围参数的值进行无提示URL编码,该值被Instagram auth终结点拒绝.我更新了组件( Xamarin.Auth ),以适应非编码范围参数并发出拉取请求.
The answer here is that YES, scopes can be requested by implicit auth flow just fine. My problem was related to an OAuth component that I was using. The component was silently URL-encoding the value of the scope param, which was rejected by the Instagram auth endpoint. I updated the component (Xamarin.Auth) to accomodate a non-encoded scope param and issued a pull request.
感谢@krisak提供了我可以测试的有效网址.
Thanks to @krisak for providing a working URL that I could test.
这篇关于Instagram API:作用域可用于OAuth2隐式身份验证流吗?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!