认证方案：Basic、Bearer/JWT 与 OAuth2

① 客户端裸访问受保护资源
② 服务器: 401 Unauthorized
          WWW-Authenticate: Basic realm="admin"    <- 告知用什么方案
③ 客户端: Authorization: <方案> <凭证>  重新请求
④ 服务器验证，放行或再 401

python3 -c '
from http.server import BaseHTTPRequestHandler, HTTPServer
import base64
 
VALID = "ada:s3cret"
 
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        auth = self.headers.get("Authorization", "")
        if auth.startswith("Basic "):
            decoded = base64.b64decode(auth[6:]).decode()
            if decoded == VALID:
                body = ("welcome, " + decoded.split(":")[0] + "\n").encode()
                self.send_response(200)
                self.send_header("Content-Length", str(len(body)))
                self.end_headers()
                self.wfile.write(body)
                return
        self.send_response(401)
        self.send_header("WWW-Authenticate", "Basic realm=\"demo\"")
        self.send_header("Content-Length", "0")
        self.end_headers()
    def log_message(self, *a):
        pass
 
HTTPServer(("127.0.0.1", 8000), H).serve_forever()
' &
for _i in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/8000) 2>/dev/null && break; sleep 0.1; done
 
echo "== 裸访问：401 + WWW-Authenticate =="
curl -si http://127.0.0.1:8000/admin | grep -E "HTTP/|WWW-Auth"
 
echo "== curl -u 自动构造 Basic 头 =="
curl -s -u ada:s3cret http://127.0.0.1:8000/admin
 
echo "== 看看头里到底是什么 =="
curl -sv -u ada:s3cret -o /dev/null http://127.0.0.1:8000/admin 2>&1 | grep -i "authorization"
 
echo "== 任何人都能解码：base64 不是加密 =="
echo "YWRhOnMzY3JldA==" | base64 -d && echo

eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiJhZGEiLCJyb2xlIjoiYWRtaW4ifQ . dBjftJeZ4CVP...
       头部(Header)          载荷(Payload)                       签名(Signature)
 
Header:    {"alg": "HS256", "typ": "JWT"}     用什么算法签名
Payload:   {"sub": "ada", "role": "admin", "exp": 1735689600}   声明(claims)
Signature: HMAC-SHA256(base64url(header) + "." + base64url(payload), 密钥)

python3 -c '
import base64, hmac, hashlib, json, time
 
SECRET = b"server-side-secret"
 
def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
 
def sign(header_payload: str) -> str:
    return b64url(hmac.new(SECRET, header_payload.encode(), hashlib.sha256).digest())
 
def issue(claims: dict) -> str:
    hp = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}).encode()) + "." + \
         b64url(json.dumps(claims).encode())
    return hp + "." + sign(hp)
 
def verify(token: str):
    try:
        hp, _, sig = token.rpartition(".")
        if not hmac.compare_digest(sig, sign(hp)):
            return None, "签名不匹配（被篡改或密钥不对）"
        payload = json.loads(base64.urlsafe_b64decode(hp.split(".")[1] + "=="))
        if payload.get("exp", 0) < time.time():
            return None, "令牌已过期"
        return payload, "OK"
    except Exception as e:
        return None, "格式错误: " + str(e)
 
token = issue({"sub": "ada", "role": "user", "exp": int(time.time()) + 3600})
print("签发的 JWT:", token[:60], "...")
print("校验结果:", verify(token)[1], "->", verify(token)[0])
print()
 
# 攻击者解码 payload，把 role 改成 admin，重新编码拼回去
hp = token.rsplit(".", 1)[0]
head, pay = hp.split(".")
hacked_pay = b64url(json.dumps({"sub": "ada", "role": "admin", "exp": 9999999999}).encode())
forged = head + "." + hacked_pay + "." + token.rsplit(".", 1)[1]
print("篡改 role=admin 后校验:", verify(forged)[1])
'

① 打印店把你重定向到网盘授权页（带 client_id、scope、redirect_uri、state）
② 你在网盘页面上登录并点击"同意授权（仅读取照片）"
③ 网盘把你重定向回打印店，URL 上带一个一次性授权码 code
④ 打印店后端拿 code + client_secret 找网盘换 access_token（服务器间通信）
⑤ 打印店用 Bearer access_token 调网盘 API 读照片