OAuth2 与刷新令牌

传统方式:
用户 → 密码 → 第三方应用 → 使用密码访问资源服务器

OAuth2 方式:
用户 → 授权确认 → 授权服务器 → 颁发令牌 → 第三方应用 → 使用令牌访问资源服务器

1. 用户(资源拥有者)访问第三方网站(客户端)
2. 网站重定向用户到微信授权服务器
3. 用户在微信授权服务器登录并同意授权
4. 授权服务器返回授权码给网站
5. 网站使用授权码向授权服务器换取 Access Token
6. 网站使用 Access Token 向资源服务器(微信API)获取用户信息

+----------+                                +------------------+
|          |                                |                  |
|  用户    |                                |  授权服务器      |
|          |                                |                  |
+----------+                                +------------------+
     |                                              ^
     | (A) 用户访问客户端                           |
     v                                              |
+----------+                                +------------------+
|          |--(B)-> 重定向到授权服务器 ----->|                  |
|  客户端  |                                |  授权服务器      |
|          |<-(C)- 返回授权码 -------------|                  |
+----------+                                +------------------+
     |                                              ^
     | (D) 使用授权码换取令牌                       |
     +----------------------------------------------+
                                                    |
                                                    v
                                            +------------------+
                                            |                  |
                                            |  资源服务器      |
                                            |                  |
                                            +------------------+

用户 → 客户端(前端) → 授权服务器
                    ↓
              直接返回 Access Token

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=password&
username=USER_NAME&
password=PASSWORD&
scope=read:user

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "REFRESH_TOKEN"
}

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=CLIENT_ID&
client_secret=CLIENT_SECRET&
scope=service:read

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "service:read"
}

// 授权码使用后立即失效
public class AuthorizationCodeService {
    private Map<String, AuthorizationCode> codeStore = new ConcurrentHashMap<>();
    
    public AuthorizationCode consumeCode(String code) {
        AuthorizationCode authCode = codeStore.remove(code); // 一次性
        if (authCode == null) {
            throw new InvalidGrantException("Invalid authorization code");
        }
        if (authCode.isExpired()) {
            throw new InvalidGrantException("Authorization code expired");
        }
        return authCode;
    }
}

// 授权码通常 5-10 分钟过期
AuthorizationCode authCode = AuthorizationCode.builder()
    .code(generateCode())
    .clientId(clientId)
    .redirectUri(redirectUri)
    .expiresAt(Instant.now().plusSeconds(600)) // 10 分钟
    .build();

// 验证时检查 redirect_uri 是否一致
if (!authCode.getRedirectUri().equals(redirectUri)) {
    throw new InvalidGrantException("Redirect URI mismatch");
}

// 1. 生成 code_verifier 和 code_challenge
function generatePKCE() {
  const codeVerifier = generateRandomString(128);
  const codeChallenge = sha256(codeVerifier);
  return { codeVerifier, codeChallenge };
}

// 2. 授权请求携带 code_challenge
const authUrl = `https://auth.example.com/authorize?
  response_type=code&
  client_id=CLIENT_ID&
  redirect_uri=REDIRECT_URI&
  code_challenge=${codeChallenge}&
  code_challenge_method=S256`;

// 3. 换取令牌时携带 code_verifier
const tokenResponse = await fetch('/oauth/token', {
  method: 'POST',
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code: authorizationCode,
    code_verifier: codeVerifier, // 证明是同一个客户端
    client_id: CLIENT_ID
  })
});

# 建议配置
access-token:
  short-lived:
    expires-in: 900  # 15 分钟(高敏感操作)
  medium-lived:
    expires-in: 3600 # 1 小时(常规业务)
  long-lived:
    expires-in: 7200 # 2 小时(内部系统)

{
  "header": {
    "alg": "RS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "user123",
    "aud": "api.example.com",
    "iss": "auth.example.com",
    "exp": 1234567890,
    "iat": 1234560000,
    "scope": "read:user write:order",
    "client_id": "client_app"
  }
}

9d8f7a6b-5c4d-3e2f-1a0b-9c8d7e6f5a4b

// 不推荐:存储在 localStorage(易受 XSS 攻击)
localStorage.setItem('refresh_token', refreshToken);

// 推荐:存储在 HttpOnly Cookie
response.setHeader("Set-Cookie", 
    "refresh_token=" + refreshToken + 
    "; HttpOnly; Secure; SameSite=Strict; Path=/oauth/token");

// 生成 Refresh Token 时绑定设备
RefreshToken token = RefreshToken.builder()
    .token(generateToken())
    .userId(userId)
    .deviceId(deviceId) // 绑定设备
    .userAgent(userAgent) // 绑定浏览器
    .ipAddress(ipAddress) // 绑定 IP(可选)
    .expiresAt(Instant.now().plus(30, ChronoUnit.DAYS))
    .build();

// 每个设备维护独立的 Refresh Token
public class RefreshTokenService {
    // key = userId:deviceId
    private Map<String, RefreshToken> tokenStore = new ConcurrentHashMap<>();
    
    public RefreshToken createToken(String userId, String deviceId) {
        String key = userId + ":" + deviceId;
        // 旧 Token 失效
        tokenStore.remove(key);
        // 生成新 Token
        RefreshToken token = generateToken(userId, deviceId);
        tokenStore.put(key, token);
        return token;
    }
}

假设 Access Token 泄露:
- 有效期 1 小时 → 最多暴露 1 小时的风险
- 有效期永久 → 风险持续到用户修改密码

假设 Refresh Token 泄露:
- 可以轮换失效
- 可以主动撤销
- 可以检测异常使用

无刷新令牌:
Access Token 过期 → 用户重新登录 → 体验差

有刷新令牌:
Access Token 过期 → 自动刷新 → 用户无感知

// 刷新时重新加载权限
public AccessToken refreshAccessToken(String refreshToken) {
    RefreshToken stored = validateRefreshToken(refreshToken);
    
    // 重新查询最新权限
    User user = userRepository.findById(stored.getUserId());
    List<String> currentScopes = user.getScopes();
    
    // 生成新的 Access Token
    return generateAccessToken(user.getId(), currentScopes);
}

@RestController
@RequestMapping("/oauth")
public class TokenController {
    
    @Autowired
    private RefreshTokenService refreshTokenService;
    
    @Autowired
    private JwtTokenProvider tokenProvider;
    
    @PostMapping("/token/refresh")
    public ResponseEntity<?> refreshToken(
            @RequestHeader("Refresh-Token") String refreshToken,
            HttpServletRequest request) {
        
        // 1. 验证 Refresh Token
        RefreshTokenValidation validation = refreshTokenService.validate(refreshToken);
        
        if (!validation.isValid()) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(Map.of("error", "invalid_grant",
                           "error_description", validation.getError()));
        }
        
        // 2. 检查设备指纹(防止令牌被盗用)
        String deviceId = extractDeviceId(request);
        if (!validation.getDeviceId().equals(deviceId)) {
            refreshTokenService.revoke(refreshToken);
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(Map.of("error", "invalid_grant",
                           "error_description", "Device mismatch"));
        }
        
        // 3. 生成新的 Access Token
        AccessTokenResponse response = tokenProvider.generateAccessToken(
            validation.getUserId(),
            validation.getScopes()
        );
        
        // 4. 轮换 Refresh Token
        if (validation.isRotationEnabled()) {
            String newRefreshToken = refreshTokenService.rotate(
                refreshToken, 
                deviceId
            );
            response.setRefreshToken(newRefreshToken);
        }
        
        return ResponseEntity.ok(response);
    }
}

@Service
public class RefreshTokenService {
    
    @Autowired
    private RefreshTokenRepository tokenRepository;
    
    public RefreshTokenValidation validate(String token) {
        // 1. 查询 Token
        Optional<RefreshToken> stored = tokenRepository.findByToken(token);
        if (stored.isEmpty()) {
            return RefreshTokenValidation.invalid("Token not found");
        }
        
        RefreshToken refreshToken = stored.get();
        
        // 2. 检查是否已撤销
        if (refreshToken.isRevoked()) {
            return RefreshTokenValidation.invalid("Token revoked");
        }
        
        // 3. 检查是否过期
        if (refreshToken.getExpiresAt().isBefore(Instant.now())) {
            return RefreshTokenValidation.invalid("Token expired");
        }
        
        // 4. 检查用户是否被锁定
        User user = userRepository.findById(refreshToken.getUserId());
        if (user.isLocked()) {
            revoke(token);
            return RefreshTokenValidation.invalid("User locked");
        }
        
        // 5. 返回验证结果
        return RefreshTokenValidation.valid(
            refreshToken.getUserId(),
            refreshToken.getScopes(),
            refreshToken.getDeviceId(),
            refreshToken.isRotationEnabled()
        );
    }
    
    // 轮换 Refresh Token
    public String rotate(String oldToken, String deviceId) {
        // 1. 撤销旧 Token
        tokenRepository.revoke(oldToken);
        
        // 2. 生成新 Token
        RefreshToken newToken = RefreshToken.builder()
            .token(UUID.randomUUID().toString())
            .userId(getUserId(oldToken))
            .deviceId(deviceId)
            .scopes(getScopes(oldToken))
            .expiresAt(Instant.now().plus(30, ChronoUnit.DAYS))
            .rotationEnabled(true)
            .build();
        
        tokenRepository.save(newToken);
        
        return newToken.getToken();
    }
}

// 前端自动刷新拦截器
class TokenRefreshInterceptor {
  constructor() {
    this.isRefreshing = false;
    this.failedQueue = [];
  }

  async intercept(error) {
    const originalRequest = error.config;
    
    // 不是 401 错误,直接返回
    if (error.response?.status !== 401) {
      return Promise.reject(error);
    }
    
    // 已经尝试过刷新,仍然失败
    if (originalRequest._retry) {
      // 跳转到登录页
      window.location.href = '/login';
      return Promise.reject(error);
    }
    
    // 如果正在刷新,将请求加入队列
    if (this.isRefreshing) {
      return new Promise((resolve, reject) => {
        this.failedQueue.push({ resolve, reject });
      }).then(() => {
        return axios(originalRequest);
      });
    }
    
    // 开始刷新
    originalRequest._retry = true;
    this.isRefreshing = true;
    
    try {
      // 调用刷新接口
      const refreshToken = getRefreshToken(); // 从 Cookie 获取
      const response = await axios.post('/oauth/token/refresh', null, {
        headers: { 'Refresh-Token': refreshToken }
      });
      
      // 更新 Access Token
      const { access_token, refresh_token } = response.data;
      setAccessToken(access_token);
      if (refresh_token) {
        setRefreshToken(refresh_token);
      }
      
      // 重试失败的请求
      this.processQueue(null, access_token);
      return axios(originalRequest);
      
    } catch (refreshError) {
      // 刷新失败,清除登录态
      this.processQueue(refreshError, null);
      clearTokens();
      window.location.href = '/login';
      return Promise.reject(refreshError);
      
    } finally {
      this.isRefreshing = false;
    }
  }
  
  processQueue(error, token = null) {
    this.failedQueue.forEach(prom => {
      if (error) {
        prom.reject(error);
      } else {
        prom.resolve(token);
      }
    });
    this.failedQueue = [];
  }
}

无轮换场景:
Refresh Token 泄露 → 攻击者可无限期使用 → 用户无法感知

有轮换场景:
1. 攻击者窃取 Refresh Token
2. 用户正常使用并刷新
3. 轮换后,攻击者的 Token 失效
4. 攻击者尝试使用旧 Token → 被检测到异常

@Service
public class RefreshTokenRotationService {
    
    // 存储最近使用过的 Token(用于检测重放)
    private Map<String, Instant> recentlyUsedTokens = new ConcurrentHashMap<>();
    
    public RefreshToken rotate(String oldToken) {
        // 1. 检查是否为已轮换的旧 Token
        if (recentlyUsedTokens.containsKey(oldToken)) {
            // 检测到重放攻击!
            // 立即撤销该用户所有 Token
            String userId = getUserId(oldToken);
            revokeAllUserTokens(userId);
            
            // 发送安全告警
            securityAlertService.sendAlert(userId, "Token replay detected");
            
            throw new SecurityException("Token replay detected");
        }
        
        // 2. 标记旧 Token 为已使用
        recentlyUsedTokens.put(oldToken, Instant.now());
        
        // 3. 定期清理过期的已用 Token 记录
        cleanupRecentlyUsedTokens();
        
        // 4. 生成新 Token
        return generateNewToken();
    }
    
    // 清理过期的已用 Token 记录(保留 24 小时)
    private void cleanupRecentlyUsedTokens() {
        Instant threshold = Instant.now().minus(24, ChronoUnit.HOURS);
        recentlyUsedTokens.entrySet().removeIf(e -> e.getValue().isBefore(threshold));
    }
}

// 定期轮换示例
public RefreshToken rotateIfNeeded(String token, int refreshCount) {
    RefreshToken stored = tokenRepository.findByToken(token);
    
    // 每刷新 5 次才轮换
    if (refreshCount % 5 == 0) {
        return rotate(token);
    }
    
    // 其他时候返回原 Token
    return stored;
}

// 后端设置 Cookie
@PostMapping("/login")
public ResponseEntity<?> login(@RequestBody LoginRequest request, 
                               HttpServletResponse response) {
    // ... 认证逻辑
    
    // 设置 Access Token(短期,可放在内存或 Cookie)
    Cookie accessTokenCookie = new Cookie("access_token", accessToken);
    accessTokenCookie.setHttpOnly(true);
    accessTokenCookie.setSecure(true);
    accessTokenCookie.setPath("/");
    accessTokenCookie.setMaxAge(900); // 15 分钟
    response.addCookie(accessTokenCookie);
    
    // 设置 Refresh Token(长期,必须 HttpOnly)
    Cookie refreshTokenCookie = new Cookie("refresh_token", refreshToken);
    refreshTokenCookie.setHttpOnly(true);
    refreshTokenCookie.setSecure(true);
    refreshTokenCookie.setPath("/oauth/token"); // 仅刷新接口可访问
    refreshTokenCookie.setMaxAge(2592000); // 30 天
    response.addCookie(refreshTokenCookie);
    
    return ResponseEntity.ok(Map.of("user", userInfo));
}

// 客户端只持有 Token ID,不持有实际 Token
public class RefreshToken {
    private String id;          // 客户端持有
    private String token;       // 服务端存储
    private String userId;
    private Instant expiresAt;
}

// 客户端请求刷新
@PostMapping("/token/refresh")
public ResponseEntity<?> refresh(@RequestBody RefreshRequest request) {
    String tokenId = request.getTokenId();
    
    // 服务端根据 ID 查询实际 Token
    RefreshToken stored = tokenRepository.findById(tokenId);
    
    // 验证并生成新 Access Token
    // ...
}

// 使用用户密码加密 Refresh Token
function encryptRefreshToken(token, userPassword) {
  return CryptoJS.AES.encrypt(token, userPassword).toString();
}

// 刷新时解密
function decryptRefreshToken(encrypted, userPassword) {
  const bytes = CryptoJS.AES.decrypt(encrypted, userPassword);
  return bytes.toString(CryptoJS.enc.Utf8);
}

// 用户登出时撤销 Refresh Token
@PostMapping("/logout")
public ResponseEntity<?> logout(@RequestBody LogoutRequest request) {
    String refreshToken = request.getRefreshToken();
    
    // 撤销指定的 Refresh Token
    refreshTokenService.revoke(refreshToken);
    
    // 如果需要,撤销该用户所有 Token
    // refreshTokenService.revokeAllUserTokens(userId);
    
    return ResponseEntity.ok().build();
}

// 撤销实现
public void revoke(String token) {
    tokenRepository.findByToken(token).ifPresent(t -> {
        t.setRevoked(true);
        t.setRevokedAt(Instant.now());
        tokenRepository.save(t);
    });
}

// 用户修改密码时撤销所有 Token
@PostMapping("/password/change")
public ResponseEntity<?> changePassword(@RequestBody ChangePasswordRequest request) {
    // ... 修改密码逻辑
    
    // 撤销所有 Refresh Token,强制重新登录
    refreshTokenService.revokeAllUserTokens(userId);
    
    return ResponseEntity.ok().build();
}

// 用户被锁定时撤销
@EventListener
public void onUserLocked(UserLockedEvent event) {
    refreshTokenService.revokeAllUserTokens(event.getUserId());
}

@Scheduled(cron = "0 0 3 * * ?") // 每天凌晨 3 点
public void cleanupExpiredTokens() {
    // 删除过期超过 7 天的 Token
    tokenRepository.deleteExpiredTokens(Instant.now().minus(7, ChronoUnit.DAYS));
}

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
    <version>1.2.0</version>
</dependency>

@Configuration
public class AuthorizationServerConfig {
    
    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        // 注册客户端应用
        RegisteredClient client = RegisteredClient.withId("1")
            .clientId("web-app")
            .clientSecret("{noop}secret") // 生产环境使用 {bcrypt}
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
            .redirectUri("http://localhost:8080/login/oauth2/code/web-app")
            .scope("read:user")
            .scope("write:order")
            .tokenSettings(
                TokenSettings.builder()
                    .accessTokenTimeToLive(Duration.ofMinutes(15))
                    .refreshTokenTimeToLive(Duration.ofDays(30))
                    .reuseRefreshTokens(false) // 启用轮换
                    .build()
            )
            .clientSettings(
                ClientSettings.builder()
                    .requireAuthorizationConsent(true) // 需要用户同意授权
                    .build()
            )
            .build();
        
        return new InMemoryRegisteredClientRepository(client);
    }
    
    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        return AuthorizationServerSettings.builder()
            .issuer("http://auth.example.com")
            .authorizationEndpoint("/oauth2/authorize")
            .tokenEndpoint("/oauth2/token")
            .tokenIntrospectionEndpoint("/oauth2/introspect")
            .tokenRevocationEndpoint("/oauth2/revoke")
            .jwkSetEndpoint("/oauth2/jwks")
            .build();
    }
    
    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) 
            throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
            .oidc(Customizer.withDefaults()); // 启用 OpenID Connect
        
        return http.build();
    }
}

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {
    
    @Bean
    @Order(2)
    public SecurityFilterChain resourceServerFilterChain(HttpSecurity http) 
            throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/api/**").authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            );
        
        return http.build();
    }
    
    // 自定义 JWT 权限转换器
    private JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            // 从 JWT 的 scope 字段提取权限
            List<String> scopes = jwt.getClaimAsStringList("scope");
            if (scopes == null) {
                return Collections.emptyList();
            }
            return scopes.stream()
                .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

@Component
public class CustomOAuth2TokenCustomizer implements OAuth2TokenCustomizer<JwtEncodingContext> {
    
    @Override
    public void customize(JwtEncodingContext context) {
        // 添加自定义声明
        context.getClaims().claims(claims -> {
            // 添加用户 ID
            claims.put("user_id", context.getPrincipal().getName());
            
            // 添加额外信息
            UserDetails user = (UserDetails) context.getPrincipal().getPrincipal();
            claims.put("email", user.getEmail());
            claims.put("tenant_id", user.getTenantId());
        });
    }
}

@Configuration
@EnableWebSecurity
public class JwtSecurityConfig {
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) 
            throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/auth/login", "/auth/refresh").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthenticationFilter(), 
                UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
    
    @Bean
    public JwtAuthenticationFilter jwtAuthenticationFilter() {
        return new JwtAuthenticationFilter(jwtTokenProvider);
    }
    
    @Bean
    public JwtTokenProvider jwtTokenProvider() {
        return new JwtTokenProvider(
            "your-256-bit-secret-key-here",
            900000L,  // Access Token 有效期: 15 分钟
            2592000000L // Refresh Token 有效期: 30 天
        );
    }
}

@RestController
@RequestMapping("/auth")
public class AuthController {
    
    @Autowired
    private AuthService authService;
    
    // 登录
    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest request,
                                   HttpServletResponse response) {
        LoginResult result = authService.login(
            request.getUsername(), 
            request.getPassword()
        );
        
        // Access Token 放在响应体(前端可访问)
        // Refresh Token 放在 HttpOnly Cookie
        
        Cookie refreshTokenCookie = new Cookie("refresh_token", result.getRefreshToken());
        refreshTokenCookie.setHttpOnly(true);
        refreshTokenCookie.setSecure(true);
        refreshTokenCookie.setPath("/auth");
        refreshTokenCookie.setMaxAge(30 * 24 * 60 * 60);
        response.addCookie(refreshTokenCookie);
        
        return ResponseEntity.ok(Map.of(
            "access_token", result.getAccessToken(),
            "expires_in", result.getExpiresIn(),
            "user", result.getUser()
        ));
    }
    
    // 刷新令牌
    @PostMapping("/refresh")
    public ResponseEntity<?> refresh(
            @CookieValue(value = "refresh_token", required = false) String refreshToken,
            HttpServletResponse response) {
        
        if (refreshToken == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(Map.of("error", "No refresh token"));
        }
        
        RefreshResult result = authService.refresh(refreshToken);
        
        // 轮换 Refresh Token
        Cookie newRefreshTokenCookie = new Cookie("refresh_token", result.getNewRefreshToken());
        newRefreshTokenCookie.setHttpOnly(true);
        newRefreshTokenCookie.setSecure(true);
        newRefreshTokenCookie.setPath("/auth");
        newRefreshTokenCookie.setMaxAge(30 * 24 * 60 * 60);
        response.addCookie(newRefreshTokenCookie);
        
        return ResponseEntity.ok(Map.of(
            "access_token", result.getAccessToken(),
            "expires_in", result.getExpiresIn()
        ));
    }
    
    // 登出
    @PostMapping("/logout")
    public ResponseEntity<?> logout(
            @CookieValue(value = "refresh_token", required = false) String refreshToken,
            HttpServletResponse response) {
        
        if (refreshToken != null) {
            authService.revokeRefreshToken(refreshToken);
        }
        
        // 清除 Cookie
        Cookie cookie = new Cookie("refresh_token", null);
        cookie.setHttpOnly(true);
        cookie.setSecure(true);
        cookie.setPath("/auth");
        cookie.setMaxAge(0);
        response.addCookie(cookie);
        
        return ResponseEntity.ok().build();
    }
}

// api.js
import axios from 'axios';

const api = axios.create({
  baseURL: '/api',
  timeout: 10000
});

// 请求拦截器:添加 Access Token
api.interceptors.request.use(config => {
  const accessToken = sessionStorage.getItem('access_token');
  if (accessToken) {
    config.headers.Authorization = `Bearer ${accessToken}`;
  }
  return config;
});

// 响应拦截器:自动刷新
api.interceptors.response.use(
  response => response,
  async error => {
    const originalRequest = error.config;
    
    // 401 且未重试过
    if (error.response?.status === 401 && !originalRequest._retry) {
      originalRequest._retry = true;
      
      try {
        // 刷新 Token(浏览器会自动携带 HttpOnly Cookie)
        const response = await axios.post('/auth/refresh');
        const { access_token } = response.data;
        
        // 更新 Access Token
        sessionStorage.setItem('access_token', access_token);
        
        // 重试原请求
        originalRequest.headers.Authorization = `Bearer ${access_token}`;
        return api(originalRequest);
        
      } catch (refreshError) {
        // 刷新失败,跳转登录
        sessionStorage.removeItem('access_token');
        window.location.href = '/login';
        return Promise.reject(refreshError);
      }
    }
    
    return Promise.reject(error);
  }
);

export default api;

@Configuration
@EnableWebSecurity
public class OAuth2LoginConfig {
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) 
            throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/", "/error").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/login")
                .authorizationEndpoint(auth -> auth
                    .baseUri("/oauth2/authorization")
                )
                .redirectionEndpoint(redir -> redir
                    .baseUri("/login/oauth2/code/*")
                )
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(oAuth2UserService())
                )
                .successHandler(oauth2LoginSuccessHandler())
            );
        
        return http.build();
    }
    
    @Bean
    public OAuth2UserService<OAuth2UserRequest, OAuth2User> oAuth2UserService() {
        DefaultOAuth2UserService delegate = new DefaultOAuth2UserService();
        
        return request -> {
            OAuth2User oauth2User = delegate.loadUser(request);
            
            // 处理用户信息,保存到数据库
            String registrationId = request.getClientRegistration().getRegistrationId();
            String userNameAttributeName = request.getClientRegistration()
                .getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
            
            // 根据不同登录源处理
            switch (registrationId) {
                case "github":
                    return processGithubUser(oauth2User);
                case "google":
                    return processGoogleUser(oauth2User);
                default:
                    return oauth2User;
            }
        };
    }
    
    private OAuth2User processGithubUser(OAuth2User oauth2User) {
        String githubId = oauth2User.getAttribute("id");
        String login = oauth2User.getAttribute("login");
        String email = oauth2User.getAttribute("email");
        String name = oauth2User.getAttribute("name");
        
        // 查找或创建本地用户
        User user = userService.findOrCreateByGithubId(githubId, login, email, name);
        
        // 返回包含本地用户信息的 OAuth2User
        return new DefaultOAuth2User(
            user.getAuthorities(),
            Map.of(
                "id", user.getId(),
                "username", user.getUsername(),
                "email", user.getEmail()
            ),
            "id"
        );
    }
    
    @Bean
    public AuthenticationSuccessHandler oauth2LoginSuccessHandler() {
        return (request, response, authentication) -> {
            // OAuth2 登录成功后,生成 JWT Token
            OAuth2User oauth2User = (OAuth2User) authentication.getPrincipal();
            
            String accessToken = jwtTokenProvider.generateAccessToken(oauth2User);
            String refreshToken = jwtTokenProvider.generateRefreshToken(oauth2User);
            
            // 设置 Cookie 或返回 JSON
            response.addCookie(createHttpOnlyCookie("refresh_token", refreshToken));
            
            // 重定向到前端,携带 Access Token
            response.sendRedirect("/dashboard?access_token=" + accessToken);
        };
    }
    
    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        return new InMemoryClientRegistrationRepository(
            githubClientRegistration(),
            googleClientRegistration()
        );
    }
    
    private ClientRegistration githubClientRegistration() {
        return ClientRegistration.withRegistrationId("github")
            .clientId("${GITHUB_CLIENT_ID}")
            .clientSecret("${GITHUB_CLIENT_SECRET}")
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
            .scope("read:user", "user:email")
            .authorizationUri("https://github.com/login/oauth/authorize")
            .tokenUri("https://github.com/login/oauth/access_token")
            .userInfoUri("https://api.github.com/user")
            .userNameAttributeName("id")
            .clientName("GitHub")
            .build();
    }
}

// 发起 GitHub 登录
function loginWithGithub() {
  window.location.href = '/oauth2/authorization/github';
}

// 处理回调
async function handleOAuthCallback() {
  const urlParams = new URLSearchParams(window.location.search);
  const accessToken = urlParams.get('access_token');
  
  if (accessToken) {
    // 存储 Access Token
    sessionStorage.setItem('access_token', accessToken);
    
    // 获取用户信息
    const user = await fetchUserInfo(accessToken);
    
    // 更新 UI
    updateUI(user);
  }
}

@Service
public class DeviceSessionService {
    
    @Autowired
    private RefreshTokenRepository tokenRepository;
    
    // 登录时创建设备会话
    public LoginResult login(String username, String password, 
                             DeviceInfo deviceInfo) {
        // 1. 认证用户
        User user = authenticate(username, password);
        
        // 2. 生成设备 ID(如果未提供)
        String deviceId = deviceInfo.getDeviceId();
        if (deviceId == null) {
            deviceId = generateDeviceId(deviceInfo);
        }
        
        // 3. 检查设备数量限制
        List<RefreshToken> activeTokens = tokenRepository
            .findByUserIdAndRevokedFalse(user.getId());
        
        if (activeTokens.size() >= MAX_DEVICES) {
            // 可选:踢掉最旧的设备
            RefreshToken oldest = activeTokens.stream()
                .min(Comparator.comparing(RefreshToken::getCreatedAt))
                .orElse(null);
            
            if (oldest != null) {
                revokeToken(oldest.getToken());
            }
        }
        
        // 4. 创建新会话
        RefreshToken refreshToken = RefreshToken.builder()
            .token(UUID.randomUUID().toString())
            .userId(user.getId())
            .deviceId(deviceId)
            .deviceName(deviceInfo.getDeviceName())
            .deviceType(deviceInfo.getDeviceType())
            .userAgent(deviceInfo.getUserAgent())
            .ipAddress(deviceInfo.getIpAddress())
            .expiresAt(Instant.now().plus(30, ChronoUnit.DAYS))
            .build();
        
        tokenRepository.save(refreshToken);
        
        // 5. 生成 Access Token
        String accessToken = generateAccessToken(user, deviceId);
        
        return LoginResult.builder()
            .accessToken(accessToken)
            .refreshToken(refreshToken.getToken())
            .deviceId(deviceId)
            .expiresIn(900L)
            .build();
    }
    
    // 获取用户所有设备会话
    public List<DeviceSession> listUserDevices(String userId) {
        return tokenRepository.findByUserIdAndRevokedFalse(userId)
            .stream()
            .map(token -> DeviceSession.builder()
                .deviceId(token.getDeviceId())
                .deviceName(token.getDeviceName())
                .deviceType(token.getDeviceType())
                .lastUsedAt(token.getLastUsedAt())
                .ipAddress(token.getIpAddress())
                .build())
            .collect(Collectors.toList());
    }
    
    // 撤销指定设备
    public void revokeDevice(String userId, String deviceId) {
        tokenRepository.revokeByUserIdAndDeviceId(userId, deviceId);
    }
    
    // 撤销所有其他设备
    public void revokeOtherDevices(String userId, String currentDeviceId) {
        tokenRepository.revokeOtherDevices(userId, currentDeviceId);
    }
}

// 设备信息
@Data
public class DeviceInfo {
    private String deviceId;
    private String deviceName;      // "iPhone 13 Pro"
    private String deviceType;      // "mobile", "desktop", "tablet"
    private String userAgent;
    private String ipAddress;
}

// API 接口
@RestController
@RequestMapping("/api/devices")
public class DeviceController {
    
    @Autowired
    private DeviceSessionService deviceSessionService;
    
    @GetMapping
    public ResponseEntity<?> listDevices(Authentication auth) {
        String userId = auth.getName();
        List<DeviceSession> devices = deviceSessionService.listUserDevices(userId);
        return ResponseEntity.ok(devices);
    }
    
    @DeleteMapping("/{deviceId}")
    public ResponseEntity<?> revokeDevice(Authentication auth,
                                          @PathVariable String deviceId) {
        String userId = auth.getName();
        deviceSessionService.revokeDevice(userId, deviceId);
        return ResponseEntity.ok().build();
    }
    
    @DeleteMapping("/others")
    public ResponseEntity<?> revokeOtherDevices(Authentication auth,
                                                @RequestParam String currentDeviceId) {
        String userId = auth.getName();
        deviceSessionService.revokeOtherDevices(userId, currentDeviceId);
        return ResponseEntity.ok().build();
    }
}

// 设备管理页面
function DeviceManager() {
  const [devices, setDevices] = useState([]);
  
  useEffect(() => {
    fetchDevices();
  }, []);
  
  const fetchDevices = async () => {
    const response = await api.get('/api/devices');
    setDevices(response.data);
  };
  
  const handleRevoke = async (deviceId) => {
    if (confirm('确定要登出此设备吗?')) {
      await api.delete(`/api/devices/${deviceId}`);
      fetchDevices();
    }
  };
  
  const handleRevokeOthers = async () => {
    if (confirm('确定要登出其他所有设备吗?')) {
      await api.delete('/api/devices/others?' + 
        new URLSearchParams({ currentDeviceId: getCurrentDeviceId() }));
      fetchDevices();
    }
  };
  
  return (
    <div>
      <h2>已登录设备</h2>
      <button onClick={handleRevokeOthers}>登出其他设备</button>
      
      <ul>
        {devices.map(device => (
          <li key={device.deviceId}>
            <strong>{device.deviceName}</strong>
            <span>{device.deviceType}</span>
            <span>最后使用: {formatTime(device.lastUsedAt)}</span>
            <span>IP: {device.ipAddress}</span>
            <button onClick={() => handleRevoke(device.deviceId)}>
              登出
            </button>
          </li>
        ))}
      </ul>
    </div>
  );
}

OAuth2 + JWT:
授权服务器使用 OAuth2 协议颁发 JWT 格式的令牌
→ 最常见的现代方案

OAuth2 + Opaque Token:
授权服务器使用 OAuth2 协议颁发随机字符串令牌
→ 传统方案,需查询验证

OAuth2 + SAML:
授权服务器使用 OAuth2 协议颁发 SAML 断言
→ 企业级场景

// 推荐的刷新失败处理
async function handleRefreshFailure(error) {
  const errorCode = error.response?.data?.error;
  
  switch (errorCode) {
    case 'invalid_grant':
      // Refresh Token 无效或过期
      // 清除登录态,跳转登录
      clearTokens();
      redirectToLogin();
      break;
      
    case 'token_revoked':
      // Token 被撤销
      // 可能是用户在其他设备登出
      showNotification('您已在其他设备登录');
      clearTokens();
      redirectToLogin();
      break;
      
    case 'user_locked':
      // 用户被锁定
      showNotification('账户已被锁定');
      clearTokens();
      redirectToLogin();
      break;
      
    case 'device_mismatch':
      // 设备不匹配,可能被盗用
      showNotification('检测到异常登录');
      clearTokens();
      redirectToLogin();
      break;
      
    default:
      // 其他错误,稍后重试
      retryOrFail();
  }
}

## OAuth2 安全检查清单

### 令牌生成
- [ ] 使用强随机数生成器
- [ ] Access Token 有效期不超过 1 小时
- [ ] Refresh Token 有效期合理(7-30 天)
- [ ] 使用 HTTPS 传输

### 令牌存储
- [ ] Access Token 不存储在 localStorage
- [ ] Refresh Token 使用 HttpOnly Cookie
- [ ] 敏感操作不依赖前端存储的令牌

### 授权码安全
- [ ] 授权码一次性使用
- [ ] 授权码有效期短(5-10 分钟)
- [ ] 验证 redirect_uri 完全匹配

### 刷新令牌安全
- [ ] 启用轮换机制
- [ ] 检测重放攻击
- [ ] 支持主动撤销
- [ ] 绑定设备信息

### 客户端安全
- [ ] 验证 client_id 和 client_secret
- [ ] 不在前端存储 client_secret
- [ ] 使用 PKCE(移动端和 SPA)

### 权限控制
- [ ] 使用最小权限原则
- [ ] scope 命名清晰
- [ ] 支持增量授权

### 监控与审计
- [ ] 记录令牌颁发和使用日志
- [ ] 监控异常刷新行为
- [ ] 定期审计活跃会话

// × 错误:设置 Refresh Token 永不过期
RefreshToken.builder()
    .expiresAt(null) // 永久有效
    .build();

// √ 正确:设置合理过期时间
RefreshToken.builder()
    .expiresAt(Instant.now().plus(30, ChronoUnit.DAYS))
    .build();

// √ 更好:定期要求重新认证
if (isDaysSinceLastLogin(refreshToken) > 90) {
    throw new AuthenticationRequiredException();
}

// × 错误:存储在 localStorage
localStorage.setItem('refresh_token', refreshToken);

// × 错误:存储在 sessionStorage
sessionStorage.setItem('refresh_token', refreshToken);

// √ 后端设置 HttpOnly Cookie
Cookie cookie = new Cookie("refresh_token", refreshToken);
cookie.setHttpOnly(true);  // 防止 JavaScript 访问
cookie.setSecure(true);    // 仅 HTTPS 传输
cookie.setSameSite("Strict"); // 防止 CSRF
response.addCookie(cookie);

// × 错误:授权码可重复使用
public AuthorizationCode getOrCreateCode(String code) {
    return codeStore.computeIfAbsent(code, this::generateCode);
}

// √ 授权码使用后立即删除
public AuthorizationCode consumeCode(String code) {
    AuthorizationCode authCode = codeStore.remove(code);
    if (authCode == null) {
        throw new InvalidGrantException("Code already used or invalid");
    }
    return authCode;
}

// √ 提供完整的生命周期管理
public interface TokenManagement {
    // 登出撤销
    void revoke(String refreshToken);
    
    // 全部撤销
    void revokeAll(String userId);
    
    // 轮换
    String rotate(String oldToken);
    
    // 验证
    TokenValidation validate(String token);
}

完整的 OAuth2 实现:
1. 客户端注册(client_id, client_secret, redirect_uri)
2. 授权端点(用户授权页面)
3. 令牌端点(颁发和刷新令牌)
4. 资源服务器(验证令牌并提供资源)
5. 用户信息端点(获取用户信息)
6. 令牌撤销端点
7. 令牌自省端点

简化方案:
仅使用 JWT 做认证,不实现完整 OAuth2 流程
→ 这不是 OAuth2,只是 JWT 认证

public RefreshToken rotate(String oldToken) {
    // 检查是否已使用过(重放攻击)
    if (isUsedToken(oldToken)) {
        // 撤销所有令牌
        revokeAllUserTokens(getUserId(oldToken));
        // 发送告警
        alertService.send(getUserId(oldToken), "Token replay detected");
        throw new SecurityException("Token replay detected");
    }
    
    // 标记为已使用
    markAsUsed(oldToken);
    
    // 生成新令牌
    return generateNewToken();
}

// 创建会话时绑定设备
RefreshToken token = RefreshToken.builder()
    .token(generateToken())
    .userId(userId)
    .deviceId(generateOrGetDeviceId(request))
    .deviceName(extractDeviceName(userAgent))
    .ipAddress(request.getRemoteAddr())
    .build();

// 撤销指定设备
public void revokeDevice(String userId, String deviceId) {
    tokenRepository.revokeByUserIdAndDeviceId(userId, deviceId);
}

async function handleRefreshError(error) {
  const errorCode = error.response?.data?.error;
  
  switch (errorCode) {
    case 'invalid_grant':
    case 'token_expired':
      clearTokens();
      redirectToLogin();
      break;
    case 'token_revoked':
      showNotification('您已在其他设备登录');
      clearTokens();
      redirectToLogin();
      break;
    case 'user_locked':
      showNotification('账户已被锁定,请联系管理员');
      clearTokens();
      redirectToLogin();
      break;
    case 'device_mismatch':
    case 'replay_detected':
      showNotification('检测到异常登录,请重新认证');
      clearTokens();
      redirectToLogin();
      break;
  }
}

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) 
            throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/api/**").authenticated()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
                .authenticationEntryPoint(customAuthenticationEntryPoint())
            );
        
        return http.build();
    }
    
    // 自定义 JWT 权限转换
    private JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<String> scopes = jwt.getClaimAsStringList("scope");
            return scopes.stream()
                .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) {
    http
        .oauth2Login(oauth2 -> oauth2
            .loginPage("/login")
            .userInfoEndpoint(userInfo -> userInfo
                .userService(customOAuth2UserService())
            )
            .successHandler(oauth2LoginSuccessHandler())
        );
    return http.build();
}

@Bean
public ClientRegistrationRepository clientRegistrationRepository() {
    return new InMemoryClientRegistrationRepository(
        ClientRegistration.withRegistrationId("github")
            .clientId("${GITHUB_CLIENT_ID}")
            .clientSecret("${GITHUB_CLIENT_SECRET}")
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
            .scope("read:user", "user:email")
            .authorizationUri("https://github.com/login/oauth/authorize")
            .tokenUri("https://github.com/login/oauth/access_token")
            .userInfoUri("https://api.github.com/user")
            .userNameAttributeName("id")
            .build()
    );
}