ios - 如何在 iOS 上处理删除帐户时成功验证苹果登录撤销 token api？

Question

根据 Account deletion requirement iOS

If your app offers Sign in with Apple, you’ll need to use the Sign in with Apple REST API to revoke user tokens when deleting an account.

引用这个answer ，我们正在尝试在我们的服务器端发送这个撤销 token API。这是一些片段

        privateKey = fs.readFileSync("xxxxxxxx.p8")
        client_secret = jwt.sign({ 
                iss: 'xxxx-xxx-xx-xxxx-xxxxxxxx',
                iat: Math.floor(Date.now() / 1000),
                exp: Math.floor(Date.now() / 1000) + 1200,
                aud: 'https://appleid.apple.com',
                sub: "sample.com"
            }, 
            privateKey, 
            { 
                algorithm: 'ES256',
                header: {
                    alg: 'ES256',
                    kid: 'xxxxxxxxxxx'
                } 
            });

        data = {
            'token': token,
            'client_id': "sample.com",
            'client_secret': client_secret
        };
        body = qs.stringify(data)

        opts =
            protocol: 'https:'
            host: 'appleid.apple.com'
            path: '/auth/revoke'
            method: 'POST'
            timeout: 6000
            headers:
                'Content-Type': 'application/x-www-form-urlencoded'
                'Content-Length': Buffer.byteLength(body)
       // call https to send this opts message

并且上述代码的状态码可以是200，响应体为空。

然而，revoke token api的响应码200|

The request was successful; the provided token has been revoked successfully or was previously invalid.

似乎状态代码 200 包含提供的 token 之前无效。如何区分revoke token API是无效token返回的还是撤销成功？

我们还尝试通过 curl 使用无效的 client_secret 和 token 来测试这个撤销 token API，状态码 200 可能会返回或者响应主体为空。这太奇怪了。

curl -v POST "https://appleid.apple.com/auth/revoke" \
-H 'content-type: application/x-www-form-urlencoded' \
-d 'client_id=xxx.xxxx.yyyy' \
-d 'client_secret=ddddddeyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlBGUVRYTTVWUlcifQ.dddd.DmMifw6qWHMqKgDIbO8KrIzDvbF7T4WxxEo9TmtN0kmTISsi8D8FG52k_LPGkbNEnS_-w_SRimEKIH1rsuawFA' \
-d 'token=dddddd' \
-d 'token_type_hint=access_token'

> POST /auth/revoke HTTP/1.1
> Host: appleid.apple.com
> User-Agent: curl/7.77.0
> Accept: */*
> content-type: application/x-www-form-urlencoded
> Content-Length: 240
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200
< Server: Apple
< Date: Thu, 09 Jun 2022 07:36:31 GMT
< Content-Length: 0
< Connection: keep-alive
< Host: appleid.apple.com

Answer 1

最后调用revoke token api(appleid.apple.com/auth/revoke)成功，Apps Using Apple ID of Settings下的apple id绑定(bind)信息被删除

---

根本原因是之前使用了无效的token。我们尝试苹果签名结果的身份 token ，它不是正确的 token 。

正确的 token 是从auth/token 返回的access_token 或refresh_token .

code - The authorization code received in an authorization response sent to your app. The code is single-use only and valid for five minutes. Authorization code validation requests require this parameter.

为了通过auth/token获取access_token或refresh_token，的code参数auth/token 请求需要注意。苹果签名的code授权响应，类型为base64。在分配给 auth/token API 之前，应该将其解码为 utf-8。

---

总结整个过程如下。

• 从 Apple 登录获取 authorizationCode。
• 通过 auth\token 使用 authorizationCode 获取没有过期时间的刷新 token \访问 token
• 通过token\revoke撤销刷新 token 或访问 token

希望以上可以帮助遇到同样问题的人。以下是 node.js 代码片段。

    getClientSecret: () ->
        client_secret = jwt.sign({ 
                            iss: 'xxxxxxxxx',
                            iat: Math.floor(Date.now() / 1000),
                            exp: Math.floor(Date.now() / 1000) + 360000,
                            aud: 'https://appleid.apple.com',
                            sub: bundleID
                        }, 
                        @privateKey, 
                        { 
                            algorithm: 'ES256',
                            header: {
                                alg: 'ES256',
                                kid: 'xxxxxxxxxx'
                            } 
                        });
        client_secret

    decodeBase64: (base64Data) ->
        buff = Buffer.from(base64Data, 'base64')
        return buff.toString('utf-8')

    revokeToken: (token) ->
        client_secret = @getClientSecret()

        data = {
            'token': token,
            'client_id': bundleID,
            'client_secret': client_secret,
            'token_type_hint': 'access_token'
        };

        body = qs.stringify(data)

        opts =
            protocol: 'https:'
            host: 'appleid.apple.com'
            path: '/auth/revoke'
            method: 'POST'
            timeout: 6000
            headers:
                'Content-Type': 'application/x-www-form-urlencoded'
                'Content-Length': Buffer.byteLength(body)

        http.post(body, opts)

    authToken: (authCode) ->
        client_secret = @getClientSecret()
        code = @decodeBase64(authCode)

        data = {
            'code': code,
            'client_id': bundleID,
            'client_secret': client_secret,
            'grant_type': 'authorization_code'
        };

        body = qs.stringify(data)

        opts =
            protocol: 'https:'
            host: 'appleid.apple.com'
            path: '/auth/token'
            method: 'POST'
            timeout: 6000
            headers:
                'Content-Type': 'application/x-www-form-urlencoded'
                'Content-Length': Buffer.byteLength(body)

        http.post(body, opts)