oauth2从访问令牌获取作用域列表

是否可以从访问令牌获取作用域列表

e、 g

---

//-->$scopes=['address'，'subscriptions'，…]

，它可以依赖于访问令牌。如果它是一个Jwt，你可以直接解码它，你可以使用测试它。许多身份验证服务器也有一个tokeninfo端点，它将为您提供有关令牌的信息。这将取决于您使用的身份验证服务器

{
  "nbf": 1514888070,
  "exp": 1514891670,
  "iss": "http://localhost:5000",
  "aud": [
    "http://localhost:5000/resources",
    "testapi"
  ],
  "client_id": "testclient",
  "sub": "21248582",
  "auth_time": 1514882023,
  "idp": "Google",
  "supporter": "21248582",
  "name": "Xxxxx",
  "application_id": "14055160",
  "scope": [
    "openid",
    "profile",
    "email",
    "testapi"
  ],
  "amr": [
    "external"
  ]
}

---

@你怎么知道他们的访问令牌是通过谷歌认证服务器创建的？如果不是的话，那也没用。

{
  "nbf": 1514888070,
  "exp": 1514891670,
  "iss": "http://localhost:5000",
  "aud": [
    "http://localhost:5000/resources",
    "testapi"
  ],
  "client_id": "testclient",
  "sub": "21248582",
  "auth_time": 1514882023,
  "idp": "Google",
  "supporter": "21248582",
  "name": "Xxxxx",
  "application_id": "14055160",
  "scope": [
    "openid",
    "profile",
    "email",
    "testapi"
  ],
  "amr": [
    "external"
  ]
}