如何在.NET中用Simple.OData.Client实现OAuth2.0授权码模式获取Access Token

步骤说明 #

Authorization Code模式分两步完成令牌获取：

1. 引导用户访问授权URL，获取授权码（code）
2. 使用授权码向Token URL请求Access Token

代码实现 #

1. 构造授权跳转URL #

var clientId = "id";
var redirectUri = "https://myserver.com/*";
var scope = "openid";
var authorizationUrl = $"https://myserver.com/auth?client_id={Uri.EscapeDataString(clientId)}&redirect_uri={Uri.EscapeDataString(redirectUri)}&response_type=code&scope={Uri.EscapeDataString(scope)}";

// 需将用户引导至该URL完成授权，Web应用可直接跳转，桌面/客户端应用可调用浏览器打开

2. 用授权码交换Access Token #

using System.Net.Http;
using System.Collections.Generic;
using System.Threading.Tasks;
using System.Text.Json;

public async Task<string> GetAccessTokenAsync(string authorizationCode)
{
    var clientId = "id";
    var clientSecret = "secret";
    var redirectUri = "https://myserver.com/*";
    var tokenUrl = "https://myserver/token";

    using var httpClient = new HttpClient();
    var formData = new Dictionary<string, string>
    {
        ["grant_type"] = "authorization_code",
        ["code"] = authorizationCode,
        ["redirect_uri"] = redirectUri,
        ["client_id"] = clientId,
        ["client_secret"] = clientSecret,
        ["scope"] = "openid"
    };

    var response = await httpClient.PostAsync(tokenUrl, new FormUrlEncodedContent(formData));
    response.EnsureSuccessStatusCode(); // 请求失败时直接抛出异常

    var tokenResponseJson = await response.Content.ReadAsStringAsync();
    // 解析为强类型对象（可选）
    var tokenResponse = JsonSerializer.Deserialize<TokenResponse>(tokenResponseJson);
    return tokenResponse?.AccessToken;
}

// 用于解析令牌响应的模型类
public class TokenResponse
{
    [JsonPropertyName("access_token")]
    public string AccessToken { get; set; }
    [JsonPropertyName("token_type")]
    public string TokenType { get; set; }
    [JsonPropertyName("expires_in")]
    public int ExpiresIn { get; set; }
    [JsonPropertyName("refresh_token")]
    public string RefreshToken { get; set; }
    [JsonPropertyName("id_token")]
    public string IdToken { get; set; }
}

注意事项 #

• authorizationCode需从授权回调URL的查询参数中获取
• 生产环境建议使用IHttpClientFactory管理HttpClient实例，避免资源泄漏
• 客户端密钥请勿硬编码，建议通过配置文件或环境变量注入

内容的提问来源于stack exchange，提问作者Sun