Google+ API:如何在每次启动应用时使用RefreshTokens来避免请求访问权限？

Question

我正在尝试使用Google+ API访问经过身份验证的用户的信息.我已从其中一个示例中复制了一些代码,这些代码工作得很好(下图),但是我无法以一种可以在应用程序启动时重用令牌的方式工作.

我尝试捕获"RefreshToken"属性并使用provider.RefreshToken()(除其他外)并始终得到400 Bad Request响应.

有谁知道如何使这项工作,或知道我在哪里可以找到一些样品？在谷歌代码网站似乎并没有涵盖这:-(

class Program
{
    private const string Scope = "https://www.googleapis.com/auth/plus.me";

    static void Main(string[] args)
    {
        var provider = new NativeApplicationClient(GoogleAuthenticationServer.Description);
        provider.ClientIdentifier = "BLAH";
        provider.ClientSecret = "BLAH";
        var auth = new OAuth2Authenticator<NativeApplicationClient>(provider, GetAuthentication);

        var plus = new PlusService(auth);
        plus.Key = "BLAH";
        var me = plus.People.Get("me").Fetch();
        Console.WriteLine(me.DisplayName);
    }

    private static IAuthorizationState GetAuthentication(NativeApplicationClient arg)
    {
        // Get the auth URL:
        IAuthorizationState state = new AuthorizationState(new[] { Scope });
        state.Callback = new Uri(NativeApplicationClient.OutOfBandCallbackUrl);
        Uri authUri = arg.RequestUserAuthorization(state);

        // Request authorization from the user (by opening a browser window):
        Process.Start(authUri.ToString());
        Console.Write("  Authorization Code: ");
        string authCode = Console.ReadLine();
        Console.WriteLine();

        // Retrieve the access token by using the authorization code:
        return arg.ProcessUserAuthorization(authCode, state);
    }
}

Answer 1

这是一个例子.确保添加名为RefreshToken的字符串设置并引用System.Security或找到另一种安全存储刷新令牌的方法.

    private static byte[] aditionalEntropy = { 1, 2, 3, 4, 5 };

    private static IAuthorizationState GetAuthorization(NativeApplicationClient arg)
    {
        // Get the auth URL:
        IAuthorizationState state = new AuthorizationState(new[] { PlusService.Scopes.PlusMe.GetStringValue() });
        state.Callback = new Uri(NativeApplicationClient.OutOfBandCallbackUrl);

        string refreshToken = LoadRefreshToken();
        if (!String.IsNullOrWhiteSpace(refreshToken))
        {
            state.RefreshToken = refreshToken;

            if (arg.RefreshToken(state))
                return state;
        }

        Uri authUri = arg.RequestUserAuthorization(state);

        // Request authorization from the user (by opening a browser window):
        Process.Start(authUri.ToString());
        Console.Write("  Authorization Code: ");
        string authCode = Console.ReadLine();
        Console.WriteLine();

        // Retrieve the access token by using the authorization code:
        var result = arg.ProcessUserAuthorization(authCode, state);

        StoreRefreshToken(state);
        return result;
    }

    private static string LoadRefreshToken()
    {
        return Encoding.Unicode.GetString(ProtectedData.Unprotect(Convert.FromBase64String(Properties.Settings.Default.RefreshToken), aditionalEntropy, DataProtectionScope.CurrentUser));
    }

    private static void StoreRefreshToken(IAuthorizationState state)
    {
        Properties.Settings.Default.RefreshToken = Convert.ToBase64String(ProtectedData.Protect(Encoding.Unicode.GetBytes(state.RefreshToken), aditionalEntropy, DataProtectionScope.CurrentUser));
        Properties.Settings.Default.Save();
    }

Answer 2

总体思路如下:

1. 您将用户重定向到Google的授权端点.

2. 您获得了一个短命的授权码.

3. 您可以使用Google的令牌端点立即与长期访问令牌交换授权码.访问令牌附带有效日期和刷新令牌.

4. 您使用访问令牌向Google的API发出请求.

您可以根据需要重复使用访问令牌,直到它过期为止.然后,您可以使用刷新令牌来请求新的访问令牌(带有新的到期日期和新的刷新令牌).

也可以看看:

• OAuth 2.0授权协议
• Google的OAuth 2.0文档