세션, JWT, OAuth2.0 인증에 대해 알아보자

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9. TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ

     +--------+                               +---------------+
     |        |--(A)- Authorization Request ->|   Resource    |
     |        |                               |     Owner     |
     |        |<-(B)-- Authorization Grant ---|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(C)-- Authorization Grant -->| Authorization |
     | Client |                               |     Server    |
     |        |<-(D)----- Access Token -------|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(E)----- Access Token ------>|    Resource   |
     |        |                               |     Server    |
     |        |<-(F)--- Protected Resource ---|               |
     +--------+                               +---------------+

                     Figure 1: Abstract Protocol Flow

     +----------+
     | Resource |
     |   Owner  |
     |          |
     +----------+
          ^
          |
         (B)
     +----|-----+          Client Identifier      +---------------+
     |         -+----(A)-- & Redirection URI ---->|               |
     |  User-   |                                 | Authorization |
     |  Agent  -+----(B)-- User authenticates --->|     Server    |
     |          |                                 |               |
     |         -+----(C)-- Authorization Code ---<|               |
     +-|----|---+                                 +---------------+
       |    |                                         ^      v
      (A)  (C)                                        |      |
       |    |                                         |      |
       ^    v                                         |      |
     +---------+                                      |      |
     |         |>---(D)-- Authorization Code ---------'      |
     |  Client |          & Redirection URI                  |
     |         |                                             |
     |         |<---(E)----- Access Token -------------------'
     +---------+       (w/ Optional Refresh Token)

       Note: The lines illustrating steps (A), (B), and (C) are broken into
	   two parts as they pass through the user-agent.

                        Figure 3: Authorization Code Flow

https://cloud.digitalocean.com/v1/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=CALLBACK_URL&scope=read

API authorization endpoint/client_id/redirect_id/response_type/scope 로 구성됩니다

https://example.com/callback?code=AUTHORIZATION_CODE

{
  "alg": "HS256",
  "type": "JWT", // optional
  "cty": "JWT" // optional
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

{
	"alg" : "HS256",
	"typ" : "JWT"
}
{
	"sub": "1234567890", "name": "John Doe", "admin": true
}

{
  "iss": "auth.example.com", // 토큰 발급자 (Issuer)
  "sub": "user-12345", // 이 토큰의 주체 (Subject) -> 사용자 ID
  "aud": "my-app", // 이 토큰을 사용할 대상 (Audience)
  "exp": 1717045200 // 만료 시간 (Expiration)
}

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "bearer",
  "expires_in": 2592000,
  "refresh_token": "REFRESH_TOKEN",
  "scope": "read",
  "uid": 100101,
  "info": {
    "name": "Mark E. Mark",
    "email": "mark@thefunkybunch.com"
  }
}

<!-- 이 태그가 악성 사이트에 삽입됨 -->
<img src="http://target.site.com/add-user?user=name&grant=admin" />