Question

我生成我的JWT，如果我的令牌是正确的，为什么不工作？在Google Developers Console中我启用了gmail plus youtube和其他API，在凭据中生成并下载了json

{
  "private_key_id": "22dcf",
  "private_key": "-----BEGIN PRIVATE KEY-----(remove)-----END PRIVATE KEY-----\n",
  "client_email": "vgfjjc6@developer.gserviceaccount.com",
  "client_id": "jc6.apps.googleusercontent.com",
  "type": "service_account"
}

首先生成令牌

 var sHead=JSON.stringify({"alg":"RS256","typ":"JWT"});    
           var iat=timeStampf();
           var exp=iat+3600;
           var sPayload=JSON.stringify({
                      "iss":client_email,
                      "scope":scope,//gmail scope  https://mail.google.com/                
                      "aud":"https://www.googleapis.com/oauth2/v3/token",
                      "exp":exp,
                      "iat":iat
                    });           
          var sJWS = KJUR.jws.JWS.sign("RS256", sHead,sPayload, private_key);
          var paramstoken="grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-ty

pe%3Ajwt-bearer&assertion="+sJWS   



   getToken("POST","/oauth2/v3/token",paramstoken,jsonData,replier);
 /*rest petition  return 200 OK 
       {
      "access_token" : "1bHLl5EOtu1pxz3fmmetKx9W8CV4t79M",
      "token_type" : "Bearer",
      "expires_in" : 3600
    }*/

接下来我测试我的令牌

function testToken(accessToken,replier)
{
 //  /gmail/v1/users/me/messages    /plus/v1/people/me
    var client = vertx.createHttpClient().host(urlbase).port(443).ssl(true).maxPoolSize(10);    
    var request = client.request("GET", "/gmail/v1/users/me/messages", function(resp) {
        console.log('server returned status code: ' + resp.statusCode());
        console.log('server returned status message: ' + resp.statusMessage());
        resp.bodyHandler(function(body) {           
            replier(JSON.parse(body.toString()));
        });
    });
    request.headers()
    .set("Content-type", contentType)
    .set("Authorization", "Bearer "+accessToken);
    request.end();
    client.close();
}

如果我使用谷歌+范围和此请愿书答案是200 ok

     https://www.googleapis.com/auth/plus.me /plus/v1/people/me
    {
"kind":"plus#person",
"etag":"\"LR9iFZQGXELLHS07eQ\"",
"objectType":"person","id":"1149981343","displayName":"","name":{"familyName":"","givenName":""},"image":{"url":"https://lh3.googleusercontent.com/-XdUIqdMkCWA/AAAAAAAAAAI/AAAAAAAAAAA/4252rscbv5M/photo.jpg?sz=50","isDefault":true},"isPlusUser":false,"language":"en_US","circledByCount":0,"verified":false}

但如果我尝试使用gmail

{"error":{"errors":[{"domain":"global","reason":"failedPrecondition","message":"Bad Request"}],"code":400,"message":"Bad Request"}}

Answer 1

对于GMail，您正在访问特定用户的数据，因此在创建JWT时，您需要指定您尝试模拟的用户，即您要访问其邮箱的用户。

您可以在形成JWT声明集时使用sub：“用户的电子邮件地址参数”来执行此操作

var sPayload=JSON.stringify({
                  "iss":client_email,
                  "sub":USER_EMAIL_ADDRESS
                  "scope":scope,//gmail scope  https://mail.google.com/                
                  "aud":"https://www.googleapis.com/oauth2/v3/token",
                  "exp":exp,
                  "iat":iat
                });

如何访问gmail API？

1 个答案: