OAuth2技术问询：能否从Access Token中获取scopes列表？

Great question! Let's break this down clearly for you:

The short answer: It depends entirely on the type of Access Token you're working with.

1. JWT (JSON Web Token) Access Tokens #

If your Access Token is a JWT (a super common format in OAuth2/OpenID Connect implementations), then yes—you absolutely can pull the scopes directly from the token itself. JWTs are self-contained, meaning they embed all their metadata (called "claims") right in the token string. The scope claim is a standard one that lists all granted permissions.

Here's how you might implement your hypothetical tokenToScopes function safely:

function tokenToScopes(string $token): array {
    // Split the JWT into its 3 required parts: header, payload, signature
    $tokenParts = explode('.', $token);
    if (count($tokenParts) !== 3) {
        throw new InvalidArgumentException("This doesn't look like a valid JWT token");
    }

    // Decode the payload (JWT uses base64url encoding, so we need to adjust characters first)
    $payload = base64_decode(str_replace(['-', '_'], ['+', '/'], $tokenParts[1]));
    $payloadData = json_decode($payload, true);

    // Extract scopes—note: they're almost always a space-separated string, not an array
    if (!isset($payloadData['scope'])) {
        return [];
    }

    return explode(' ', $payloadData['scope']);
}

// Usage example
$token = 'ab12...'; // Your actual JWT Access Token
$scopes = tokenToScopes($token);
// Result: ['address', 'subscriptions', ...]

A critical reminder: Always validate the JWT's signature before trusting any claims inside it. Skipping this check leaves you open to tampered tokens. Most OAuth2 libraries have built-in methods to decode and validate JWTs safely—avoid rolling your own full validation unless you're confident in the details.

2. Opaque Access Tokens #

If your Access Token is opaque (just a random, meaningless string with no embedded data), then you cannot extract scopes directly from the token. Opaque tokens are designed to only be interpretable by the OAuth2 provider that issued them. To get the scopes, you need to call the provider's token introspection endpoint.

Here's a rough example of how that might work:

function getOpaqueTokenScopes(string $token, string $introspectionUrl, string $clientId, string $clientSecret): array {
    $requestContext = stream_context_create([
        'http' => [
            'method' => 'POST',
            'header' => "Content-Type: application/x-www-form-urlencoded\r\n" .
                        "Authorization: Basic " . base64_encode("$clientId:$clientSecret"),
            'content' => http_build_query(['token' => $token])
        ]
    ]);

    $response = file_get_contents($introspectionUrl, false, $requestContext);
    $tokenData = json_decode($response, true);

    return isset($tokenData['scope']) ? explode(' ', $tokenData['scope']) : [];
}

Quick Recap #

• For JWT tokens: Decode the payload (after verifying the signature) to pull scopes directly.
• For opaque tokens: Call the provider's introspection endpoint to fetch token details including scopes.

内容的提问来源于stack exchange，提问作者Chris