问题描述
在 Auth0 中,您可以使用 刷新令牌.在这个链接中,我们可以看到很多返回的参数:
In Auth0 you can use refresh tokens. In this link, we can see many returned parameters:
lock.showSignin({ authParams: { scope: 'openid offline_access' } }, function (err, profile, id_token, access_token, state, refresh_token) { // store refresh_token });
显然,access_tokens 可用于检索用户配置文件数据.但这似乎是oauth特有的,我认为auth0使用openid?
Apparently, access_tokens can be used to retrieve user profile data. But this appears to be specific to oauth, and I thought auth0 uses openid?
id_token和access_token有什么区别?
推荐答案
OpenID Connect 建立在 OAuth2 之上.
OpenID Connect is built on top of OAuth2.
- access_token 可用于调用 Auth0 中的某些 API(例如 /userinfo)或您在 Auth0 中定义的 API.
- id_token 是 JWT,代表登录用户.您的应用程序经常使用它.
- refresh_token(仅供移动/桌面应用程序使用)不会过期(但可撤销),它允许您获得新铸造的 access_tokens 和id_token.
- An access_token is useful to call certain APIs in Auth0 (e.g. /userinfo) or an API you define in Auth0.
- An id_token is a JWT and represents the logged in user. It is often used by your app.
- A refresh_token (only to be used by a mobile/desktop app) doesn't expire (but is revokable) and it allows you to obtain freshly minted access_tokens and id_token.