关于新浪微博单点登录的问题

╰+哭是因爲堅強的太久メ 2022-05-20 05:59 144阅读 0赞

地址：[https://www.v2ex.com/t/398974][https_www.v2ex.com_t_398974]

最近在学习 oauth2 协议,准备自己实现一套..

在分析新浪微博的单点登录的功能的时候发现一个问题.

我首先登录了微博,按理来说就会拥有微博的 session.

![8073a037gy1fknlz5bk8pj20yp06rmzs.jpg][]

然后我在登录网易云音乐,然后选择使用微博登录,提示还是需要登录并授权

![8073a037gy1fknm01wjdtj20h208raab.jpg][]

我已经登录了微博不能直接授权吗?

不知道有没有大佬来解释一下呢?

11 回复  |  直到 2017-10-19 16:49:27 +08:00

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">1</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      首先，要确定一件事：网易云音乐的微博登录是什么场景下弹出的。是同一浏览器的 web 页，还是客户端的 webview ？&nbsp; 
     <br> 
     <br>其次，这种问题一般去看下官方文档就有答案了。&nbsp; 
     <br> 
     <img src="http://wx4.sinaimg.cn/large/4960720fly1fknmysfo55j214i12q7d4.jpg" alt="">&nbsp; 
     <br> 
     <a href="http://open.weibo.com/wiki/%E6%8E%88%E6%9D%83%E6%9C%BA%E5%88%B6" style="color:rgb(119,128,135);" rel="nofollow">http://open.weibo.com/wiki/%E6%8E%88%E6%9D%83%E6%9C%BA%E5%88%B6</a> 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/gravatar/9d1e3ee79a6c9f6b52d6b7c7714f53b7?s=48&amp;d=retro" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">2</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/p2pCoder" style="color:#808080;" rel="nofollow">p2pCoder</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      你登录的站点和微博的 api 授权站点是不同的站点，是不会 session 共享的&nbsp; 
     <br>如果设计成共享的，那么就可以使用很多方式来 盗取 可以使用新浪微博 oauth2 登录的第三方网站的账号了。 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">3</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);"> 
     <img src="http://wx3.sinaimg.cn/large/4960720fly1fknn3t7zvmj215w0zmthi.jpg" alt="">&nbsp; 
     <br>另外说下，登录时如果引入强制登录的参数，会在每次授权时必须让用户去填用户密码&nbsp; 
     <br> 
     <br> 
     <br>强制登录&nbsp; 
     <br> 
     <br>授权页会默认读取当前用户的微博登录状态，如果你想让用户重新登录，请在调用 authorize 接口时传入参数：forcelogin=true，默认不填写此参数相当于 forcelogin=false 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/7705/b0fc/248803_normal.png?m=1512615231" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">4</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/zhouyou457" style="color:#808080;" rel="nofollow">zhouyou457</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      @ 
     <a href="https://www.v2ex.com/member/TimePPT" style="color:rgb(119,128,135);" rel="nofollow">TimePPT</a>&nbsp;是网页版的网易云,点击微博登录直接跳转到&nbsp; 
     <br> 
     <br> 
     <a href="https://api.weibo.com/oauth2/authorize?client_id=301575942&amp;response_type=code&amp;redirect_uri=http://music.163.com/back/weibo&amp;forcelogin=true&amp;scope=friendships_groups_read,statuses_to_me_read,follow_app_official_microblog&amp;state=xVTnXJNVSK" style="color:rgb(119,128,135);" rel="nofollow">https://api.weibo.com/oauth2/authorize?client_id=301575942&amp;response_type=code&amp;redirect_uri=http://music.163.com/back/weibo&amp;forcelogin=true&amp;scope=friendships_groups_read,statuses_to_me_read,follow_app_official_microblog&amp;state=xVTnXJNVSK</a>&nbsp; 
     <br> 
     <br>而且在微博-&gt;管理中心-&gt;我的应用 里面可以看见我已经授权了网易云音乐 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/gravatar/0b76a9d6128304af56f3b28583fb989c?s=48&amp;d=retro" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">5</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/LinJunzhu" style="color:#808080;" rel="nofollow">LinJunzhu</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      歪个题， 单点登录 SSO 跟 oauth2 是两回事 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">6</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span>&nbsp;&nbsp;&nbsp;<span style="color:rgb(204,204,204);font-size:11px;">♥ 1</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      @ 
     <a href="https://www.v2ex.com/member/zhouyou457" style="color:rgb(119,128,135);" rel="nofollow">zhouyou457</a>&nbsp;看你 url，再看我上面那条 forcelogin=true 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">8</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      @ 
     <a href="https://www.v2ex.com/member/zhouyou457" style="color:rgb(119,128,135);" rel="nofollow">zhouyou457</a>&nbsp;是的，这样便利性会低，但安全性会高一些，特别是多人共用电脑，或频繁更换浏览器微博账号的用户比较合适。 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">9</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      @ 
     <a href="https://www.v2ex.com/member/zhouyou457" style="color:rgb(119,128,135);" rel="nofollow">zhouyou457</a>&nbsp;所以整个过程是&nbsp; 
     <br>曾经向网易云授权过微博登录——&gt;重新使用微博登录网易云——&gt;发现 token 过期——&gt;跳转至授权页——&gt;授权参数带有强制登录参数——&gt;登录界面 
    </div></td> 
  </tr> 
 </tbody> 
</table>

<table style="table-layout:fixed;"> 
 <tbody> 
  <tr> 
   <td align="center"><img src="https://cdn.v2ex.com/avatar/626d/dccd/62211_normal.png?m=1517825608" alt=""></td> 
   <td>&nbsp;</td> 
   <td align="left"> 
    <div style="text-align:right;">
      &nbsp; &nbsp;&nbsp; 
     <span style="font-size:9px;line-height:9px;background-color:rgb(240,240,240);color:rgb(204,204,204);">11</span> 
    </div> 
    <div></div><strong><a href="https://www.v2ex.com/member/TimePPT" style="color:#808080;" rel="nofollow">TimePPT</a></strong>&nbsp; &nbsp;<span style="font-size:11px;color:rgb(204,204,204);">266 天前</span> 
    <div></div> 
    <div style="line-height:1.6;color:rgb(0,0,0);">
      @ 
     <a href="https://www.v2ex.com/member/zhouyou457" style="color:rgb(119,128,135);" rel="nofollow">zhouyou457</a>&nbsp;客气，因为工作原因，主持过多家公司的登录注册优化，QQ 微信 微博 三者的 Oath 登录比较熟而已 
    </div></td> 
  </tr> 
 </tbody> 
</table>

[https_www.v2ex.com_t_398974]: https://www.v2ex.com/t/398974
[8073a037gy1fknlz5bk8pj20yp06rmzs.jpg]: /images/20220520/12ea2995e6754b4ebab26b0e32ef11b0.png
[8073a037gy1fknm01wjdtj20h208raab.jpg]: /images/20220520/b80783bf69594ad0a364f48997fcd639.png