“这个应用程序想要:离线访问"当 access_type=online 时

问题描述

我有一个采用 OAuth 2.0 身份验证的 Google 应用.过去一切正常，但最近我开始收到以下请求许可"屏幕:

I have a Google App with OAuth 2.0 authentication. Everything used to work fine but recently I started getting the following "Request for permission" screen:

奇怪的是，当我通过 access_type=online 时，我得到了这个屏幕.再说一次，这直到最近才有效.

The strange part is that I get this screen when I pass access_type=online. Again, this used to work until recently.

这可能是什么原因?TIA

What can be the cause for this? TIA

请求的范围是:

https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile

我已经试过了:

• 有和没有 access_type=online
• 有和没有 approval_prompt=auto

编辑 #2:

这是我用来生成身份验证 URL 的 python 代码:

This is the python code I'm using to generate the authentication URL:

encoded_params = urllib.urlencode({
    "response_type" : "code",
    "client_id" : MY_CLIENT_ID,
    "scope" : " ".join(MY_SCOPES),
    "redirect_uri" : MY_REDIRECT_URI,
    "state" : random_security_token,
    "access_type" : "online",
    "approval_prompt" : "auto",
    })

auth_url = "https://accounts.google.com/o/oauth2/auth?" + encoded_params

更新(10 月 14 日):

即使使用新范围，我仍然会看到同意屏幕.最近，我为用于身份验证的新设备获得了它.

Even with the new scopes, I still get the consent screen. Recently I got it for a new device I was using for the authentication.

推荐答案

我认为 G 会在您的应用请求令牌并且对于相关范围的用户仍然有有效的访问或刷新令牌时执行此操作.

I think G does this when your app requests a token and there is still a valid access or refresh token for the user for the scopes in question.

解决方案是在您使用完令牌后(在用户注销时或在对用户进行身份验证后立即)通过发出此请求来撤销令牌:

The solution is to revoke tokens when you're done with them (either on user logout or immediately after authenticating the user) by issuing this request:

https://accounts.google.com/o/oauth2/revoke?token={token}

您无需提供任何应用凭据，只需将令牌作为 URL 参数即可.

You don't have to provide any app credentials, just the token as a URL argument.

(此处的文档https://developers.google.com/accounts/docs/OAuth2WebServer#tokenrevoke)

我遇到了同样的问题，access_type 或 approval_prompt 值的组合似乎无法解决它.撤销令牌就成功了.

I had the same problem and no combination of access_type or approval_prompt values seemed to solve it. Revoking the token did the trick.

我不确定如何为您的应用撤销所有未完成的令牌，除非您碰巧存储了它们.要使用您自己的用户帐户进行测试，您可以在此处手动撤销您应用的现有令牌:

I'm not sure how to revoke all outstanding tokens for your app, unless you happened to store them. To test with your own user account, you can manually revoke the existing token for your app here:

https://security.google.com/settings/security/permissions

这篇关于“这个应用程序想要:离线访问"当 access_type=online 时的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！