Refresh Token authorization server taraf\u0131ndan mevcutta olan Access Token’\u0131n expire s\u00fcresi sona ermeye yakla\u015ft\u0131\u011f\u0131nda veya sona erdi\u011finde,\u00a0yeni bir Access Token elde edebilmek\u00a0i\u00e7in client’a verilir. Refresh Token’\u0131n kullan\u0131m\u0131 opsiyonel olup, authorization server taraf\u0131ndan Access Token al\u0131naca\u011f\u0131 zaman, Refresh Token da beraberinde verilir.<\/p>\n Not<\/strong>:\u00a0Unutulmamal\u0131d\u0131r ki Refresh Token, Access Token’\u0131n aksine sadece authorization server ile kullan\u0131lmak i\u00e7in tasarlanm\u0131\u015f olup, resource server’a g\u00f6nderilmemektedir.<\/p><\/blockquote>\n Dilerseniz Refresh Token’\u0131n \u00e7al\u0131\u015fma mant\u0131\u011f\u0131na, a\u015fa\u011f\u0131da \u00e7izmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131m\u00a0sequence diyagram\u0131 \u00fczerinden\u00a0bir bakal\u0131m.<\/p>\n <\/p>\n Yukar\u0131daki ak\u0131\u015fa bakt\u0131\u011f\u0131m\u0131zda, client \u00f6nce\u00a0authorization yetkilerini alabilmek i\u00e7in authorization server’a gidiyor ve buradan Access Token’\u0131 ve Refresh Token’\u0131 elde ediyor. Daha sonra Access Token ile birlikte resource server’a eri\u015febiliyor ve istedi\u011fi response’u alabiliyor. Daha sonra tekrardan ayn\u0131 Access Token bilgisi ile resource server’a geri geliyor ve bu sefer “invalid token error” hatas\u0131 ile kar\u015f\u0131la\u015f\u0131yor. Burada client’\u0131n Access Token bilgisinin expire oldu\u011funu g\u00f6r\u00fcyoruz. Client ilgili hatan\u0131n ard\u0131ndan daha \u00f6nce elde etmi\u015f oldu\u011fu Refresh Token’\u0131 kullanarak\u00a0resource server yerine,<\/strong> direkt olarak authorization server’a gidiyor ve yeni bir access token ve opsiyonel olarak varsa bir refresh token da elde ediyor. Ak\u0131\u015f bu \u015fekilde devam etmektedir.<\/p>\n Implementasyon i\u015flemi t\u0131pk\u0131 Token Based Authentication’da oldu\u011fu gibi gayet basittir. Bu i\u015flemi “Microsoft.Owin.Security.Infrastructure” namespace’i alt\u0131nda bulunan\u00a0IAuthenticationTokenProvider<\/strong> interface’ini implemente ederek ger\u00e7ekle\u015ftirece\u011fiz. Implementasyon i\u015flemine ba\u015flamadan \u00f6nce\u00a0Asp.Net Web API’da Token Based Authentication<\/a>\u00a0<\/em>makalesine\u00a0geri d\u00f6n\u00fcp, makale sonundaki projeyi indirmemiz gerekmektedir. \u00d6rnek projeyi elde etti\u011fimize g\u00f6re, “OAuth>Providers” klas\u00f6r\u00fc alt\u0131nda\u00a0SimpleRefreshTokenProvider<\/strong> isminde yeni bir class ekleyelim.\u00a0IAuthenticationTokenProvider\u00a0<\/strong>interface’ini implemente edelim ve\u00a0Refresh Token’\u0131n olu\u015fturulabilmesini sa\u011flayacak olan “Create” method’unun implementasyonundan a\u015fa\u011f\u0131daki gibi ba\u015flayal\u0131m.<\/p>\n “CreateAsync” method’u i\u00e7erisinden “Create” method’unu \u00e7a\u011f\u0131r\u0131yoruz ve ayn\u0131 i\u015flemler i\u00e7in tekrardan bir kod tekrar\u0131 i\u015flemi ger\u00e7ekle\u015ftirmiyoruz. “Create” method’una bakt\u0131\u011f\u0131m\u0131zda ise “OwinContext.Environment” \u00fczerinden “Microsoft.Owin.Form#collection” key’i ile access_token alabilmek i\u00e7in g\u00f6nderilen parametrelere “FormCollection” \u00fczerinden a\u015fa\u011f\u0131daki gibi eri\u015fiyoruz.<\/p>\n Burada “grant_type” parametresinin refresh_token olup olmad\u0131\u011f\u0131na bak\u0131yoruz ve bu duruma g\u00f6re context’e bir token set ediyoruz veya etmiyoruz. Bu kontrol\u00fc yapmam\u0131zdaki sebep ise access_token expire oldu\u011funda veya olmaya yak\u0131n oldu\u011funda client, refresh_token ile server’a geldi\u011finde tekrardan ge\u00e7erli\u00a0bir access_token daha \u00fcretilirken yeni bir refresh_token daha \u00fcretilmemesi i\u00e7indir. E\u011fer sizler business’\u0131n\u0131z gere\u011fi her seferinde yeni bir access_token \u00fcretilirken refresh_token’da \u00fcretilsin istiyorsan\u0131z, bu kontrol\u00fc bu noktada es ge\u00e7ebilirsiniz.<\/p>\n Bu i\u015flemlere ek olarak da \u00fcretilen refresh_token’\u0131n expire s\u00fcresi, “Startup.cs” class’\u0131 i\u00e7erisinde daha \u00f6nceden AccessTokenExpireTimeSpan<\/strong> parametresi \u00fczerinden\u00a0access_token i\u00e7in belirlemi\u015f oldu\u011fumuz expire s\u00fcresi ile ayn\u0131 de\u011feri ta\u015f\u0131maktad\u0131r. Bu durumda e\u011fer spesifik olarak herhangi bir de\u011fer atamazsan\u0131z, access_token sona erdi\u011finde refresh_token’da sona erece\u011fi i\u00e7in yeni bir token \u00fcretilemeyecektir. “Create” method’u i\u00e7erisinde a\u015fa\u011f\u0131daki\u00a0kod par\u00e7ac\u0131\u011f\u0131 ile refresh_token’\u0131n expire s\u00fcresini spesifik olarak belirleyebilmek m\u00fcmk\u00fcnd\u00fcr.<\/p>\n Implementasyon i\u015flemine \u015fimdi “Receive” method’u ile devam edece\u011fiz. Bu method ise server’a refresh_token ile gelindi\u011finde, gerekli kontrolleri yaparak yeni bir access_token \u00fcretilmesinden sorumlu olan method’dur. Implementasyon i\u015flemini a\u015fa\u011f\u0131daki gibi ger\u00e7ekle\u015ftirelim.<\/p>\n “ReceiveAsync” method’u i\u00e7erisinden “Receive” method’unu \u00e7a\u011f\u0131r\u0131yoruz ve implementasyon\u00a0i\u015flemlerini burada ger\u00e7ekle\u015ftiriyoruz. Burada “context.Token” parametresi ile gelen token’\u0131, “context.DeserializeTicket” method’u ile token’\u0131n deserialization i\u015flemini ger\u00e7ekle\u015ftiriyoruz.\u00a0Deserialization i\u015fleminden sonra “context.Ticket” \u0131n null kontrol\u00fcn\u00fc ger\u00e7ekle\u015ftirip, context i\u00e7erisine “SetTicket” method’u ile token’\u0131\u00a0aktar\u0131yoruz. Bu i\u015flemlerin ard\u0131ndan Owin bizim i\u00e7in ge\u00e7erli di\u011fer kontrolleri de sa\u011flayarak, yeni bir access_token \u00fcretimini ger\u00e7ekle\u015ftirecektir. Null kontrol\u00fcnde ise sizlerinde bildi\u011fi \u00fczere ge\u00e7ersiz bir token gelmi\u015f ve deserialization i\u015flemi null olarak ger\u00e7ekle\u015fmi\u015ftir. Bu durumda context \u00fczerine “context.Ticket” property’sini set edemeyece\u011fimiz i\u00e7in i\u00e7erisinde 400 status koduna sahip “invalid token” response’unu geriye d\u00f6n\u00fcyoruz.<\/p>\n Implementasyon i\u015flemi bu kadar \u015fimdi sadece olu\u015fturmu\u015f oldu\u011fumuz bu “SimpleRefreshTokenProvider” \u0131n “Startup.cs” i\u00e7erisine tan\u0131t\u0131lmas\u0131 kald\u0131. Bu i\u015flemin \u00f6ncesinde ise dilerseniz provider’\u0131n tam implemente edilmi\u015f bir halini g\u00f6relim.<\/p>\n \u015eimdi “Startup.cs” i a\u00e7al\u0131m ve “ConfigureOAuth” method’u i\u00e7erisinde “RefreshTokenProvider” property’sini a\u015fa\u011f\u0131daki gibi tan\u0131mlayal\u0131m.<\/p>\n Art\u0131k t\u00fcm yap\u0131\u00a0haz\u0131r durumda. Test i\u015flemlerimizi bir \u00f6nceki makalede de oldu\u011fu gibi Postman<\/strong> \u00fczerinden\u00a0ger\u00e7ekle\u015ftirece\u011fiz. \u00d6rne\u011fimizde access_token 1 dakikal\u0131k bir expire s\u00fcresine sahip olurken,\u00a0refresh_token ise 2 dakikal\u0131k bir s\u00fcreye sahip olacak. Projeyi\u00a0\u00e7al\u0131\u015ft\u0131ral\u0131m\u00a0ve Postman \u00fczerinden “http:\/\/localhost:55992\/token<\/em>” URI’\u0131na a\u015fa\u011f\u0131daki gibi bir POST request olu\u015ftural\u0131m.<\/p>\n Headers\u2019e eklenecek parametreler:<\/p>\n Header<\/strong>: Accept \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Value<\/strong>: application\/json Body k\u0131sm\u0131na eklenecek parametreleri de a\u015fa\u011f\u0131daki gibi set edelim ve POST i\u015flemini ger\u00e7ekle\u015ftirelim.<\/p>\n POST i\u015fleminin sonucunda “access_token” ve “refresh_token” \u0131 elde ettik. “expires_in” property’sinde ise 1 dakikal\u0131k bir s\u00fcreye sahip olabildi\u011fini g\u00f6rebiliyoruz.<\/p>\n “access_token” \u0131 kullanarak bir \u00f6nceki makalemizde oldu\u011fu gibi “Orders” resource’unu kullanal\u0131m. Bunun i\u00e7in yine Postman \u00fczerinden “http:\/\/localhost:55992\/api\/orders\/list<\/em>” URI’\u0131na a\u015fa\u011f\u0131daki Headers parametrelerini kullanarak bir GET iste\u011finde bulunal\u0131m ve execute edelim.<\/p>\n “Orders” resource’unu access_token ile ba\u015far\u0131l\u0131 bir \u015fekilde consume edebildik. 1 dakikan\u0131n sonunda ise ayn\u0131 access_token ile ayn\u0131 resource’a tekrardan bir GET iste\u011finde bulunal\u0131m ve response’a bir bakal\u0131m.<\/p>\n Ge\u00e7en 1 dakikan\u0131n ard\u0131ndan g\u00f6rd\u00fc\u011f\u00fcm\u00fcz gibi access_token expire oldu\u011fu i\u00e7in “Authorization has been denied for this request.” hatas\u0131n\u0131 ald\u0131k. Hat\u0131rlarsak refresh_token’\u0131n expire s\u00fcresini ise 2 dakika olarak belirleyece\u011fiz demi\u015ftik. Hemen tekrardan “http:\/\/localhost:55992\/token<\/em>” URI’\u0131na refresh_token’\u0131 kullanarak a\u015fa\u011f\u0131daki gibi bir POST iste\u011finde bulunal\u0131m.<\/p>\n Headers\u2019e eklenecek parametreler:<\/p>\n Header<\/strong>: Accept \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Value<\/strong>: application\/json Body k\u0131sm\u0131na eklenecek parametreleri de a\u015fa\u011f\u0131daki gibi set edelim ve POST i\u015flemini ger\u00e7ekle\u015ftirelim.<\/p>\n![\"token-authentication\"](\"\/wp-content\/uploads\/2016\/09\/token-authentication.png\")
<\/a><\/p>\nRefresh Token Nedir?<\/h4>\n
Refresh Token Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h4>\n
![\"refresh-token-mechanism\"](\"\/wp-content\/uploads\/2016\/09\/refresh-token-mechanism.jpg\")
<\/a><\/p>\nRefresh Token Implementasyonu<\/h4>\n
using System.Linq;\r\nusing System.Threading.Tasks;\r\nusing Microsoft.Owin;\r\nusing Microsoft.Owin.Security.Infrastructure;\r\n\r\nnamespace AspNetWebAPIOAuth.OAuth.Providers\r\n{\r\n public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider\r\n {\r\n public async Task CreateAsync(AuthenticationTokenCreateContext context)\r\n {\r\n Create(context);\r\n }\r\n\r\n public void Create(AuthenticationTokenCreateContext context)\r\n {\r\n object owinCollection;\r\n context.OwinContext.Environment.TryGetValue(\"Microsoft.Owin.Form#collection\", out owinCollection);\r\n\r\n var grantType = ((FormCollection)owinCollection)?.GetValues(\"grant_type\").FirstOrDefault();\r\n\r\n if (grantType == null || grantType.Equals(\"refresh_token\")) return;\r\n\r\n \/\/Dilerseniz access_token'dan farkl\u0131 olarak refresh_token'\u0131n expire time'\u0131n\u0131 da belirleyebilir, uzatabilirsiniz \r\n \/\/context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(1);\r\n\r\n context.SetToken(context.SerializeTicket());\r\n }\r\n }\r\n}<\/pre>\n![\"owincollection\"](\"\/wp-content\/uploads\/2016\/09\/owinCollection.jpg\")
<\/a><\/p>\ncontext.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(1);<\/pre>\n
using System.Linq;\r\nusing System.Threading.Tasks;\r\nusing Microsoft.Owin;\r\nusing Microsoft.Owin.Security.Infrastructure;\r\n\r\nnamespace AspNetWebAPIOAuth.OAuth.Providers\r\n{\r\n public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider\r\n {\r\n public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)\r\n {\r\n Receive(context);\r\n }\r\n\r\n public void Receive(AuthenticationTokenReceiveContext context)\r\n {\r\n context.DeserializeTicket(context.Token);\r\n\r\n if (context.Ticket == null)\r\n {\r\n context.Response.StatusCode = 400;\r\n context.Response.ContentType = \"application\/json\";\r\n context.Response.ReasonPhrase = \"invalid token\";\r\n return;\r\n }\r\n\r\n context.SetTicket(context.Ticket);\r\n }\r\n }\r\n}<\/pre>\nusing System.Linq;\r\nusing System.Threading.Tasks;\r\nusing Microsoft.Owin;\r\nusing Microsoft.Owin.Security.Infrastructure;\r\n\r\nnamespace AspNetWebAPIOAuth.OAuth.Providers\r\n{\r\n public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider\r\n {\r\n public async Task CreateAsync(AuthenticationTokenCreateContext context)\r\n {\r\n Create(context);\r\n }\r\n\r\n public void Create(AuthenticationTokenCreateContext context)\r\n {\r\n object owinCollection;\r\n context.OwinContext.Environment.TryGetValue(\"Microsoft.Owin.Form#collection\", out owinCollection);\r\n\r\n var grantType = ((FormCollection)owinCollection)?.GetValues(\"grant_type\").FirstOrDefault();\r\n\r\n if (grantType == null || grantType.Equals(\"refresh_token\")) return;\r\n\r\n \/\/Dilerseniz access_token'dan farkl\u0131 olarak refresh_token'\u0131n expire time'\u0131n\u0131 da belirleyebilir, uzatabilirsiniz \r\n \/\/context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(1);\r\n\r\n context.SetToken(context.SerializeTicket());\r\n }\r\n\r\n public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)\r\n {\r\n Receive(context);\r\n }\r\n\r\n public void Receive(AuthenticationTokenReceiveContext context)\r\n {\r\n context.DeserializeTicket(context.Token);\r\n\r\n if (context.Ticket == null)\r\n {\r\n context.Response.StatusCode = 400;\r\n context.Response.ContentType = \"application\/json\";\r\n context.Response.ReasonPhrase = \"invalid token\";\r\n return;\r\n }\r\n\r\n context.SetTicket(context.Ticket);\r\n }\r\n }\r\n}<\/pre>\nOAuthAuthorizationServerOptions oAuthAuthorizationServerOptions = new OAuthAuthorizationServerOptions()\r\n{\r\n TokenEndpointPath = new Microsoft.Owin.PathString(\"\/token\"), \/\/ token alaca\u011f\u0131m\u0131z path'i belirtiyoruz\r\n AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(1),\r\n AllowInsecureHttp = true,\r\n Provider = new SimpleAuthorizationServerProvider(),\r\n RefreshTokenProvider = new SimpleRefreshTokenProvider()\r\n};<\/pre>\n
\nHeader<\/strong>: Content-Type \u00a0 \u00a0 Value<\/strong>: application\/x-www-form-urlencoded<\/p>\n![\"access_token_1\"](\"\/wp-content\/uploads\/2016\/09\/access_token_1.jpg\")
<\/a><\/p>\n![\"access_token_2\"](\"\/wp-content\/uploads\/2016\/09\/access_token_2.jpg\")
<\/a><\/p>\n![\"access_token_3\"](\"\/wp-content\/uploads\/2016\/09\/access_token_3.jpg\")
<\/a><\/p>\n
\nHeader<\/strong>: Content-Type \u00a0 \u00a0 Value<\/strong>: application\/x-www-form-urlencoded<\/p>\n
![\"access_token_4\"](\"\/wp-content\/uploads\/2016\/09\/access_token_4.jpg\")
<\/a><\/p>\n