{"id":115805,"date":"2026-10-13T12:25:11","date_gmt":"2026-10-13T04:25:11","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/115805.html"},"modified":"2026-10-13T12:25:11","modified_gmt":"2026-10-13T04:25:11","slug":"authlib-%e4%b8%ad-rfc-8414-oauth-2-0-%e6%8e%88%e6%9d%83%e6%9c%8d%e5%8a%a1%e5%99%a8%e5%85%83%e6%95%b0%e6%8d%ae%ef%bc%88authorization-server-metadata%ef%bc%89%e5%ae%8c%e6%95%b4%e6%8c%87%e5%8d%97","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/115805.html","title":{"rendered":"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357"},"content":{"rendered":"<h3 class=\"gcb-project-title\">\u3010\u514d\u8d39\u4e0b\u8f7d\u94fe\u63a5\u3011authlib<\/h3>\n<p class=\"gcb-project-desc\">The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.<\/p>\n<p>    <span class=\"gcb-project-addr-label\">\u9879\u76ee\u5730\u5740&#xff1a;<\/span><br \/>\n    <span class=\"gcb-project-addr-link\">https:\/\/gitcode.com\/gh_mirrors\/au\/authlib<\/span> <\/p>\n<p>  <span class=\"gcb-project-btn\"> <span class=\"gcb-project-btn-main\">\u70b9\u51fb\u67e5\u770b<\/span> <span class=\"gcb-project-btn-sub\">\u514d\u8d39\u4e0b\u8f7d<\/span> <\/span> <\/p>\n<p>RFC 8414&#xff08;OAuth 2.0 Authorization Server Metadata&#xff09;\u5b9a\u4e49\u4e86\u4e00\u5957\u6807\u51c6\u5316\u7684\u5143\u6570\u636e\u683c\u5f0f&#xff0c;\u8ba9 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u80fd\u591f\u4ee5\u673a\u5668\u53ef\u8bfb\u7684 JSON \u6587\u6863\u53d1\u5e03\u81ea\u8eab\u7684\u7aef\u70b9\u5730\u5740\u3001\u652f\u6301\u7684\u6388\u6743\u7c7b\u578b\u3001\u7b7e\u540d\u7b97\u6cd5\u7b49\u80fd\u529b\u4fe1\u606f&#xff0c;\u5ba2\u6237\u7aef\u636e\u6b64\u5b9e\u73b0\u81ea\u52a8\u53d1\u73b0\u4e0e\u96f6\u914d\u7f6e\u63a5\u5165\u3002\u672c\u6587\u4ee5 Authlib \u4e2d rfc8414 \u6a21\u5757 \u7684\u5b9e\u73b0\u4e3a\u4e3b\u4f53&#xff0c;\u7cfb\u7edf\u8bb2\u89e3 AuthorizationServerMetadata \u7684 22 \u4e2a\u6807\u51c6\u5143\u6570\u636e\u5b57\u6bb5\u3001well-known URL \u7684\u751f\u6210\u89c4\u5219\u3001\u9010\u5b57\u6bb5\u7684\u6821\u9a8c\u903b\u8f91&#xff08;REQUIRED \/ OPTIONAL \/ RECOMMENDED \u4e0e\u9ed8\u8ba4\u503c&#xff09;&#xff0c;\u5e76\u6df1\u5165\u5256\u6790 validate(metadata_classes&#061;&#8230;) \u6269\u5c55\u673a\u5236\u2014\u2014\u5b83\u5982\u4f55\u4e0e RFC 9101&#xff08;JAR&#xff09;\u3001RFC 9207\u3001OpenID Connect Discovery \u7b49\u6a21\u5757\u7ec4\u5408&#xff0c;\u4ee5\u53ca\u8d44\u6e90\u670d\u52a1\u5668\u5982\u4f55\u501f\u52a9 jwks_uri \u52a8\u6001\u83b7\u53d6\u7b7e\u540d\u5bc6\u94a5\u3002\u8bfb\u5b8c\u672c\u6587&#xff0c;\u4f60\u5c06\u80fd\u591f\u5728\u81ea\u5df1\u7684\u6388\u6743\u670d\u52a1\u5668\u4e2d\u53d1\u5e03\u5408\u89c4\u7684 RFC 8414 \u5143\u6570\u636e&#xff0c;\u5e76\u638c\u63e1 Authlib \u5ba2\u6237\u7aef\u4fa7\u7684\u670d\u52a1\u53d1\u73b0\u7528\u6cd5\u3002<\/p>\n<h3>RFC 8414 \u662f\u4ec0\u4e48&#xff1a;\u4e3a\u4ec0\u4e48\u6388\u6743\u670d\u52a1\u5668\u9700\u8981\u5143\u6570\u636e<\/h3>\n<p>\u5728 OAuth 2.0 \u751f\u6001\u4e2d&#xff0c;\u5ba2\u6237\u7aef\u8981\u5b8c\u6210\u6388\u6743\u7801\u6d41\u7a0b&#xff0c;\u81f3\u5c11\u9700\u8981\u77e5\u9053\u6388\u6743\u7aef\u70b9&#xff08;authorization_endpoint&#xff09;\u548c\u4ee4\u724c\u7aef\u70b9&#xff08;token_endpoint&#xff09;&#xff1b;\u8981\u5b9e\u73b0\u4ee4\u724c\u64a4\u9500\u3001\u5185\u7701\u3001\u52a8\u6001\u5ba2\u6237\u7aef\u6ce8\u518c&#xff0c;\u8fd8\u9700\u8981\u77e5\u9053 revocation_endpoint\u3001introspection_endpoint\u3001registration_endpoint\u3002\u4f20\u7edf\u505a\u6cd5\u662f\u8fd9\u4e9b\u7aef\u70b9\u88ab\u786c\u7f16\u7801\u5728\u5ba2\u6237\u7aef\u914d\u7f6e\u91cc&#xff0c;\u6bcf\u6362\u4e00\u4e2a\u6388\u6743\u670d\u52a1\u5668\u5c31\u8981\u6539\u4e00\u6b21\u914d\u7f6e\u3002<\/p>\n<p>RFC 8414 \u89e3\u51b3\u4e86\u8fd9\u4e2a\u95ee\u9898&#xff1a;\u5b83\u89c4\u5b9a\u6388\u6743\u670d\u52a1\u5668\u5728\u56fa\u5b9a\u7684 well-known \u4f4d\u7f6e\u53d1\u5e03\u4e00\u4efd JSON \u5143\u6570\u636e\u6587\u6863&#xff0c;\u5ba2\u6237\u7aef\u53ea\u9700\u77e5\u9053\u4e00\u4e2a issuer&#xff08;\u7b7e\u53d1\u8005\u6807\u8bc6&#xff09;&#xff0c;\u5373\u53ef\u81ea\u52a8\u83b7\u53d6\u5176\u4f59\u5168\u90e8\u7aef\u70b9\u4e0e\u80fd\u529b\u4fe1\u606f\u3002\u8fd9\u4e0e OpenID Connect Discovery&#xff08;oidc\/discovery \u6a21\u5757&#xff09;\u7684\u673a\u5236\u540c\u6e90&#xff0c;\u4f46 RFC 8414 \u662f\u7eaf OAuth 2.0 \u5c42\u9762\u7684\u6807\u51c6&#xff0c;\u4e0d\u4f9d\u8d56 OpenID Connect \u6269\u5c55\u3002<\/p>\n<p>Authlib \u5728 authlib.oauth2.rfc8414 \u5305\u4e2d\u63d0\u4f9b\u4e86\u5b8c\u6574\u7684\u5b9e\u73b0&#xff0c;\u5bf9\u5916\u53ea\u5bfc\u51fa\u4e24\u4e2a\u6210\u5458&#xff08;\u89c1 __init__.py&#xff09;&#xff1a;<\/p>\n<ul>\n<li>AuthorizationServerMetadata&#xff1a;\u5143\u6570\u636e\u6a21\u578b\u7c7b&#xff0c;\u7ee7\u627f\u81ea dict&#xff0c;\u5185\u7f6e\u5168\u5957\u5b57\u6bb5\u6821\u9a8c\u903b\u8f91&#xff1b;<\/li>\n<li>get_well_known_url&#xff1a;\u6839\u636e issuer \u8ba1\u7b97 well-known \u5143\u6570\u636e URL \u7684\u5de5\u5177\u51fd\u6570\u3002<\/li>\n<\/ul>\n<h3>\u53d1\u5e03\u5143\u6570\u636e&#xff1a;AuthorizationServerMetadata \u4e0e 22 \u4e2a\u6807\u51c6\u5b57\u6bb5<\/h3>\n<p>AuthorizationServerMetadata \u662f\u4e00\u4e2a\u7ee7\u627f\u81ea Python \u5185\u7f6e dict \u7684\u7c7b&#xff0c;\u56e0\u6b64\u65e2\u53ef\u4ee5\u7528\u5b57\u5178\u7684\u65b9\u5f0f\u76f4\u63a5\u6784\u9020&#xff0c;\u4e5f\u53ef\u4ee5\u50cf\u8bbf\u95ee\u5c5e\u6027\u4e00\u6837\u8bfb\u5199\u5b57\u6bb5&#xff08;\u7c7b\u5185\u5b9e\u73b0\u4e86 __getattr__&#xff0c;\u5bf9 REGISTRY_KEYS \u4e2d\u7684\u5b57\u6bb5\u81ea\u52a8\u56de\u9000\u5230 self.get(key)&#xff09;\u3002\u5176\u6838\u5fc3\u5b9a\u4e49\u89c1 models.py\u3002<\/p>\n<p>\u7c7b\u7684 REGISTRY_KEYS \u5217\u8868\u5b8c\u6574\u7f57\u5217\u4e86 RFC 8414 Section 2 \u5b9a\u4e49\u7684\u6807\u51c6\u5143\u6570\u636e\u952e&#xff0c;\u5171 22 \u9879&#xff1a;<\/p>\n<table>\n<tr>\u5143\u6570\u636e\u952e\u8981\u6c42\u7ea7\u522b\u542b\u4e49\u4e0e\u6821\u9a8c\u8981\u70b9&#xff08;\u6765\u81ea\u6e90\u7801 docstring \u4e0e\u6821\u9a8c\u5b9e\u73b0&#xff09;<\/tr>\n<tbody>\n<tr>\n<td>issuer<\/td>\n<td>REQUIRED<\/td>\n<td>\u6388\u6743\u670d\u52a1\u5668\u7684\u7b7e\u53d1\u8005\u6807\u8bc6&#xff0c;\u5fc5\u987b\u4f7f\u7528 https scheme&#xff0c;\u4e14\u4e0d\u5141\u8bb8\u643a\u5e26 query \u6216 fragment&#xff1b;\u7f3a\u5931\u3001\u975e https\u3001\u542b\u67e5\u8be2\u4e32\u6216\u7247\u6bb5\u90fd\u4f1a\u89e6\u53d1 ValueError<\/td>\n<\/tr>\n<tr>\n<td>authorization_endpoint<\/td>\n<td>\u6761\u4ef6 REQUIRED<\/td>\n<td>\u6388\u6743\u7aef\u70b9 URL&#xff1b;\u5fc5\u987b https\u3002\u9664\u975e grant_types_supported \u4e2d\u4e0d\u542b authorization_code \u548c implicit&#xff08;\u5373\u6ca1\u6709\u4f7f\u7528\u6388\u6743\u7aef\u70b9\u7684\u6388\u6743\u7c7b\u578b&#xff09;&#xff0c;\u5426\u5219\u7f3a\u5931\u5373\u62a5\u9519<\/td>\n<\/tr>\n<tr>\n<td>token_endpoint<\/td>\n<td>\u6761\u4ef6 REQUIRED<\/td>\n<td>\u4ee4\u724c\u7aef\u70b9 URL&#xff1b;\u5fc5\u987b https\u3002\u4ec5\u5f53 grant_types_supported \u53ea\u5305\u542b implicit \u4e00\u79cd\u65f6\u5141\u8bb8\u7f3a\u5931<\/td>\n<\/tr>\n<tr>\n<td>jwks_uri<\/td>\n<td>OPTIONAL<\/td>\n<td>JWK Set \u6587\u6863 URL&#xff0c;\u5ba2\u6237\u7aef\u7528\u5b83\u9a8c\u8bc1\u6388\u6743\u670d\u52a1\u5668\u7684 JWS \u7b7e\u540d&#xff1b;\u5fc5\u987b https&#xff0c;\u53ef\u4e3a\u7a7a<\/td>\n<\/tr>\n<tr>\n<td>registration_endpoint<\/td>\n<td>OPTIONAL<\/td>\n<td>RFC 7591 \u52a8\u6001\u5ba2\u6237\u7aef\u6ce8\u518c\u7aef\u70b9 URL&#xff1b;\u5fc5\u987b https&#xff0c;\u53ef\u4e3a\u7a7a<\/td>\n<\/tr>\n<tr>\n<td>scopes_supported<\/td>\n<td>RECOMMENDED<\/td>\n<td>\u670d\u52a1\u5668\u652f\u6301\u7684 scope \u503c\u6570\u7ec4&#xff1b;\u51fa\u73b0\u65f6\u5fc5\u987b\u662f JSON \u6570\u7ec4<\/td>\n<\/tr>\n<tr>\n<td>response_types_supported<\/td>\n<td>REQUIRED<\/td>\n<td>\u652f\u6301\u7684 response_type \u503c\u6570\u7ec4&#xff08;\u53d6\u503c\u540c RFC 7591&#xff09;&#xff1b;\u7f3a\u5931\u5373\u62a5\u9519&#xff0c;\u4e14\u5fc5\u987b\u662f\u6570\u7ec4<\/td>\n<\/tr>\n<tr>\n<td>response_modes_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u652f\u6301\u7684 response_mode \u503c\u6570\u7ec4&#xff1b;\u7701\u7565\u65f6\u9ed8\u8ba4 [&#034;query&#034;, &#034;fragment&#034;]<\/td>\n<\/tr>\n<tr>\n<td>grant_types_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u652f\u6301\u7684\u6388\u6743\u7c7b\u578b\u6570\u7ec4&#xff1b;\u7701\u7565\u65f6\u9ed8\u8ba4 [&#034;authorization_code&#034;, &#034;implicit&#034;]<\/td>\n<\/tr>\n<tr>\n<td>token_endpoint_auth_methods_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u4ee4\u724c\u7aef\u70b9\u652f\u6301\u7684\u5ba2\u6237\u7aef\u8ba4\u8bc1\u65b9\u5f0f\u6570\u7ec4&#xff1b;\u7701\u7565\u65f6\u9ed8\u8ba4 client_secret_basic<\/td>\n<\/tr>\n<tr>\n<td>token_endpoint_auth_signing_alg_values_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u4ee4\u724c\u7aef\u70b9 JWT \u5ba2\u6237\u7aef\u8ba4\u8bc1&#xff08;private_key_jwt \/ client_secret_jwt&#xff09;\u652f\u6301\u7684 JWS \u7b97\u6cd5\u6570\u7ec4&#xff1b;\u4e00\u65e6\u542f\u7528\u4e86\u8fd9\u4e24\u79cd\u8ba4\u8bc1\u65b9\u5f0f\u5219\u5fc5\u987b\u63d0\u4f9b&#xff0c;\u4e14\u7981\u6b62\u5305\u542b none<\/td>\n<\/tr>\n<tr>\n<td>service_documentation<\/td>\n<td>OPTIONAL<\/td>\n<td>\u9762\u5411\u5f00\u53d1\u8005\u7684\u4eba\u7c7b\u53ef\u8bfb\u6587\u6863 URL&#xff1b;\u5fc5\u987b\u662f\u4e00\u4e2a\u5408\u6cd5 URL<\/td>\n<\/tr>\n<tr>\n<td>ui_locales_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u7528\u6237\u754c\u9762\u652f\u6301\u7684\u8bed\u8a00&#xff0c;BCP 47 \u8bed\u8a00\u6807\u7b7e\u6570\u7ec4&#xff08;\u5982 en-US\u3001zh-Hans-CN&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>op_policy_uri<\/td>\n<td>OPTIONAL<\/td>\n<td>\u5ba2\u6237\u7aef\u6ce8\u518c\u8005\u9605\u8bfb\u7684\u7b56\u7565\u6587\u6863 URL&#xff1b;\u5fc5\u987b\u5408\u6cd5 URL&#xff08;\u8be5\u5b57\u6bb5\u867d\u5e26 op_ \u524d\u7f00&#xff0c;\u4f46\u6309 RFC 8414 \u5c5e\u4e8e\u901a\u7528 OAuth 2.0 \u7279\u6027&#xff0c;\u5e76\u975e OpenID \u4e13\u5c5e&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>op_tos_uri<\/td>\n<td>OPTIONAL<\/td>\n<td>\u670d\u52a1\u6761\u6b3e\u6587\u6863 URL&#xff1b;\u5fc5\u987b\u5408\u6cd5 URL<\/td>\n<\/tr>\n<tr>\n<td>revocation_endpoint<\/td>\n<td>OPTIONAL<\/td>\n<td>RFC 7009 \u64a4\u9500\u7aef\u70b9 URL&#xff1b;\u5fc5\u987b https<\/td>\n<\/tr>\n<tr>\n<td>revocation_endpoint_auth_methods_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u64a4\u9500\u7aef\u70b9\u5ba2\u6237\u7aef\u8ba4\u8bc1\u65b9\u5f0f\u6570\u7ec4&#xff1b;\u7701\u7565\u65f6\u9ed8\u8ba4 client_secret_basic<\/td>\n<\/tr>\n<tr>\n<td>revocation_endpoint_auth_signing_alg_values_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u64a4\u9500\u7aef\u70b9 JWT \u8ba4\u8bc1\u7b7e\u540d\u7b97\u6cd5\u6570\u7ec4&#xff1b;\u89c4\u5219\u540c\u4ee4\u724c\u7aef\u70b9\u7684\u5bf9\u5e94\u5b57\u6bb5<\/td>\n<\/tr>\n<tr>\n<td>introspection_endpoint<\/td>\n<td>OPTIONAL<\/td>\n<td>RFC 7662 \u5185\u7701\u7aef\u70b9 URL&#xff1b;\u5fc5\u987b https<\/td>\n<\/tr>\n<tr>\n<td>introspection_endpoint_auth_methods_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u5185\u7701\u7aef\u70b9\u5ba2\u6237\u7aef\u8ba4\u8bc1\u65b9\u5f0f\u6570\u7ec4&#xff1b;\u7701\u7565\u65f6\u9ed8\u8ba4 client_secret_basic<\/td>\n<\/tr>\n<tr>\n<td>introspection_endpoint_auth_signing_alg_values_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>\u5185\u7701\u7aef\u70b9 JWT \u8ba4\u8bc1\u7b7e\u540d\u7b97\u6cd5\u6570\u7ec4&#xff1b;\u89c4\u5219\u540c\u4e0a<\/td>\n<\/tr>\n<tr>\n<td>code_challenge_methods_supported<\/td>\n<td>OPTIONAL<\/td>\n<td>RFC 7636 PKCE \u652f\u6301\u7684 code_challenge_method \u6570\u7ec4&#xff1b;\u7701\u7565\u8868\u793a\u670d\u52a1\u5668\u4e0d\u652f\u6301 PKCE<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u9700\u8981\u7279\u522b\u7559\u610f\u7684\u662f\u8868\u5185\u5404\u5b57\u6bb5\u7684\u9ed8\u8ba4\u503c\u8bed\u4e49\u3002\u6e90\u7801\u901a\u8fc7\u540c\u540d property \u5b9e\u73b0\u9ed8\u8ba4\u503c\u515c\u5e95&#xff08;\u89c1 models.py&#xff09;&#xff1a;<\/p>\n<ul>\n<li>response_modes_supported \u7701\u7565\u65f6\u9ed8\u8ba4 [&#034;query&#034;, &#034;fragment&#034;]&#xff1b;<\/li>\n<li>grant_types_supported \u7701\u7565\u65f6\u9ed8\u8ba4 [&#034;authorization_code&#034;, &#034;implicit&#034;]&#xff1b;<\/li>\n<li>token_endpoint_auth_methods_supported\u3001revocation_endpoint_auth_methods_supported\u3001introspection_endpoint_auth_methods_supported \u7701\u7565\u65f6\u5747\u9ed8\u8ba4 [&#034;client_secret_basic&#034;]\u3002<\/li>\n<\/ul>\n<p>\u8fd9\u4e9b\u9ed8\u8ba4\u503c\u540c\u65f6\u4e5f\u662f&#034;\u6761\u4ef6 REQUIRED&#034;\u6821\u9a8c\u7684\u5224\u5b9a\u4f9d\u636e&#xff1a;\u4f8b\u5982\u5f53 grant_types_supported \u7f3a\u7701&#xff08;\u89c6\u4e3a\u652f\u6301\u6388\u6743\u7801\u4e0e\u9690\u5f0f&#xff09;\u65f6&#xff0c;authorization_endpoint \u5c31\u5fc5\u987b\u5b58\u5728\u3002<\/p>\n<h3>\u9010\u5b57\u6bb5\u6821\u9a8c\u673a\u5236&#xff1a;validate() \u7684\u5b8c\u6574\u6267\u884c\u6d41\u7a0b<\/h3>\n<p>AuthorizationServerMetadata \u7684\u6838\u5fc3\u80fd\u529b\u662f validate() \u65b9\u6cd5&#xff08;\u89c1 models.py&#xff09;&#xff0c;\u5b83\u4f1a\u6309 REGISTRY_KEYS \u7684\u987a\u5e8f&#xff0c;\u4e3a\u6bcf\u4e00\u4e2a\u5143\u6570\u636e\u952e\u8c03\u7528\u5bf9\u5e94\u7684 validate_&lt;key&gt; \u65b9\u6cd5\u3002\u7531\u4e8e\u7c7b\u4e2d\u5b9a\u4e49\u4e86 __getattr__ \u5c5e\u6027\u8bbf\u95ee\u56de\u9000&#xff0c;\u6821\u9a8c\u65b9\u6cd5\u53ef\u4ee5\u76f4\u63a5\u4ee5 self.grant_types_supported \u7684\u5f62\u5f0f\u8bfb\u53d6\u5b57\u6bb5\u503c&#xff0c;\u5373\u4f7f\u5b57\u6bb5\u4e0d\u5b58\u5728\u4e5f\u80fd\u62ff\u5230\u9ed8\u8ba4\u503c\u3002<\/p>\n<p>\u4ee5 issuer \u7684\u6821\u9a8c&#xff08;validate_issuer&#xff0c;\u89c1 models.py&#xff09;\u4e3a\u4f8b&#xff0c;\u5b83\u5b8c\u6574\u5b9e\u73b0\u4e86 RFC 8414 \u7684\u4e09\u6761\u786c\u6027\u8981\u6c42&#xff1a;<\/p>\n<li>\u5fc5\u987b\u5b58\u5728\u2014\u2014\u7f3a\u5931\u65f6\u629b\u51fa ValueError(&#039;&#034;issuer&#034; is required&#039;)&#xff1b;<\/li>\n<li>\u5fc5\u987b\u4f7f\u7528 https\u2014\u2014\u901a\u8fc7 authlib.common.security.is_secure_transport \u68c0\u67e5&#xff0c;\u4e0d\u6ee1\u8db3\u65f6\u629b\u51fa ValueError(&#039;&#034;issuer&#034; MUST use &#034;https&#034; scheme&#039;)&#xff1b;<\/li>\n<li>\u65e0 query \u4e0e fragment\u2014\u2014\u901a\u8fc7 urlparse \u89e3\u6790\u540e\u68c0\u67e5 query \u4e0e fragment&#xff0c;\u4efb\u4e00\u5b58\u5728\u5373\u629b\u9519\u3002<\/li>\n<p>\u800c authorization_endpoint \u7684\u6821\u9a8c&#xff08;models.py&#xff09;\u5c55\u793a\u4e86&#034;\u6761\u4ef6 REQUIRED&#034;\u7684\u5178\u578b\u903b\u8f91&#xff1a;<\/p>\n<p>grant_types_supported &#061; set(self.grant_types_supported)<br \/>\nauthorization_grant_types &#061; {&#034;authorization_code&#034;, &#034;implicit&#034;}<br \/>\nif grant_types_supported &amp; authorization_grant_types:<br \/>\n    raise ValueError(&#039;&#034;authorization_endpoint&#034; is required&#039;)<\/p>\n<p>\u5373&#xff1a;\u53ea\u8981\u670d\u52a1\u5668\u58f0\u660e\u652f\u6301\u6388\u6743\u7801\u6216\u9690\u5f0f\u4efb\u4e00\u6388\u6743\u7c7b\u578b&#xff0c;\u5c31\u5fc5\u987b\u63d0\u4f9b\u6388\u6743\u7aef\u70b9&#xff1b;\u53cd\u4e4b&#xff08;\u4f8b\u5982\u53ea\u652f\u6301 password&#xff09;\u5219\u53ef\u4ee5\u7701\u7565\u3002<\/p>\n<p>\u5bf9\u4e8e\u4e09\u4e2a&#034;JWT \u5ba2\u6237\u7aef\u8ba4\u8bc1\u7b7e\u540d\u7b97\u6cd5&#034;\u5b57\u6bb5&#xff0c;Authlib \u7528\u5171\u4eab\u7684 _validate_alg_values \u8f85\u52a9\u51fd\u6570&#xff08;\u89c1 models.py&#xff09;\u7edf\u4e00\u5904\u7406\u4ea4\u53c9\u7ea6\u675f&#xff1a;<\/p>\n<ul>\n<li>\u5b57\u6bb5\u51fa\u73b0\u4f46\u975e\u6570\u7ec4\u65f6&#xff0c;\u629b\u51fa ValueError(&#039;&#8230; MUST be JSON array&#039;)&#xff1b;<\/li>\n<li>\u82e5\u5bf9\u5e94\u7684 *_auth_methods_supported \u4e2d\u51fa\u73b0\u4e86 private_key_jwt \u6216 client_secret_jwt&#xff0c;\u5219\u8be5\u5b57\u6bb5\u5fc5\u987b\u5b58\u5728&#xff0c;\u5426\u5219\u629b\u9519&#xff1b;<\/li>\n<li>\u5b57\u6bb5\u503c\u4e2d\u7981\u6b62\u51fa\u73b0 &#034;none&#034;&#xff0c;\u5426\u5219\u629b\u9519\u3002<\/li>\n<\/ul>\n<p>\u6b64\u5916\u8fd8\u6709\u4e09\u4e2a\u901a\u7528\u6821\u9a8c\u8f85\u52a9\u51fd\u6570&#xff1a;<\/p>\n<ul>\n<li>validate_array_value&#xff1a;\u6821\u9a8c\u5b57\u6bb5\u82e5\u5b58\u5728\u5219\u5fc5\u987b\u662f list&#xff1b;<\/li>\n<li>validate_language_tags_array&#xff1a;\u5728\u6570\u7ec4\u6821\u9a8c\u57fa\u7840\u4e0a&#xff0c;\u7528 authlib.common.language.is_valid_language_tag \u9010\u9879\u6821\u9a8c BCP 47 \u8bed\u8a00\u6807\u7b7e&#xff08;\u975e\u6cd5\u6807\u7b7e\u5982 fr_FR\u3001a-US \u4f1a\u89e6\u53d1\u9519\u8bef&#xff09;&#xff1b;<\/li>\n<li>validate_boolean_value&#xff1a;\u6821\u9a8c\u5e03\u5c14\u5b57\u6bb5\u5fc5\u987b\u662f True \u6216 False&#xff0c;\u4f9b\u5404\u6269\u5c55\u6a21\u5757\u590d\u7528\u3002<\/li>\n<\/ul>\n<h3>\u6784\u9020\u5143\u6570\u636e\u6587\u6863\u7684\u5b9e\u8df5\u793a\u4f8b<\/h3>\n<p>\u7ed3\u5408\u4e0a\u8ff0\u5b57\u6bb5\u5b9a\u4e49\u4e0e\u6821\u9a8c\u89c4\u5219&#xff0c;\u4e00\u4e2a\u6700\u5c0f\u53ef\u7528\u7684 RFC 8414 \u5143\u6570\u636e\u6587\u6863\u5e94\u5305\u542b issuer\u3001authorization_endpoint\u3001token_endpoint\u3001response_types_supported \u56db\u4e2a\u5fc5\u586b\u9879&#xff0c;\u5b8c\u6574\u793a\u4f8b&#xff1a;<\/p>\n<p>from authlib.oauth2.rfc8414 import AuthorizationServerMetadata<\/p>\n<p>data &#061; {<br \/>\n    &#034;issuer&#034;: &#034;https:\/\/auth.example.com&#034;,<br \/>\n    &#034;authorization_endpoint&#034;: &#034;https:\/\/auth.example.com\/authorize&#034;,<br \/>\n    &#034;token_endpoint&#034;: &#034;https:\/\/auth.example.com\/token&#034;,<br \/>\n    &#034;jwks_uri&#034;: &#034;https:\/\/auth.example.com\/jwks.json&#034;,<br \/>\n    &#034;registration_endpoint&#034;: &#034;https:\/\/auth.example.com\/register&#034;,<br \/>\n    &#034;response_types_supported&#034;: [&#034;code&#034;, &#034;token&#034;],<br \/>\n    &#034;response_modes_supported&#034;: [&#034;query&#034;, &#034;fragment&#034;],<br \/>\n    &#034;grant_types_supported&#034;: [&#034;authorization_code&#034;, &#034;implicit&#034;, &#034;refresh_token&#034;],<br \/>\n    &#034;token_endpoint_auth_methods_supported&#034;: [<br \/>\n        &#034;client_secret_basic&#034;,<br \/>\n        &#034;private_key_jwt&#034;,<br \/>\n    ],<br \/>\n    &#034;token_endpoint_auth_signing_alg_values_supported&#034;: [&#034;RS256&#034;],<br \/>\n    &#034;scopes_supported&#034;: [&#034;openid&#034;, &#034;profile&#034;, &#034;email&#034;],<br \/>\n    &#034;revocation_endpoint&#034;: &#034;https:\/\/auth.example.com\/revoke&#034;,<br \/>\n    &#034;introspection_endpoint&#034;: &#034;https:\/\/auth.example.com\/introspect&#034;,<br \/>\n    &#034;code_challenge_methods_supported&#034;: [&#034;S256&#034;],<br \/>\n    &#034;service_documentation&#034;: &#034;https:\/\/docs.example.com\/oauth&#034;,<br \/>\n    &#034;ui_locales_supported&#034;: [&#034;en-US&#034;, &#034;zh-Hans-CN&#034;],<br \/>\n}<\/p>\n<p>metadata &#061; AuthorizationServerMetadata(data)<br \/>\nmetadata.validate()<\/p>\n<p>validate() \u901a\u8fc7\u540e\u5373\u53ef\u5c06\u8be5\u5b57\u5178\u5e8f\u5217\u5316\u4e3a JSON&#xff0c;\u5e76\u53d1\u5e03\u5230\u4e0b\u6587\u6240\u8ff0\u7684 well-known URL \u4e0a\u3002\u82e5\u5143\u6570\u636e\u4e2d\u5b58\u5728\u8fdd\u89c4\u9879&#xff08;\u4f8b\u5982 issuer \u7528\u4e86 http:\/\/&#xff0c;\u6216 response_types_supported \u5199\u6210\u4e86\u5b57\u7b26\u4e32 &#034;code&#034; \u800c\u975e\u6570\u7ec4&#xff09;&#xff0c;validate() \u4f1a\u629b\u51fa\u5e26\u5177\u4f53\u539f\u56e0\u7684 ValueError&#xff0c;\u8fd9\u4e9b\u884c\u4e3a\u5747\u6709\u5bf9\u5e94\u6d4b\u8bd5\u8986\u76d6&#xff08;\u89c1 test_rfc8414.py&#xff09;\u3002<\/p>\n<h3>\u8ba1\u7b97 well-known URL&#xff1a;get_well_known_url \u7684\u89c4\u5219\u4e0e\u8fb9\u754c\u60c5\u51b5<\/h3>\n<p>RFC 8414 Section 3.1 \u89c4\u5b9a&#xff0c;\u5143\u6570\u636e\u6587\u6863\u53d1\u5e03\u5728\u5982\u4e0b\u4f4d\u7f6e&#xff1a;<\/p>\n<p>https:\/\/example.com\/.well-known\/oauth-authorization-server<\/p>\n<p>\u4f46\u5f53 issuer \u5e26\u6709\u8def\u5f84\u65f6&#xff0c;\u89c4\u5219\u4f1a\u7a0d\u590d\u6742&#xff1a;\u8def\u5f84\u90e8\u5206\u9700\u8981\u62fc\u63a5\u5230 well-known \u524d\u7f00\u4e4b\u540e\u3002Authlib \u7684 get_well_known_url \u51fd\u6570&#xff08;\u89c1 well_known.py&#xff09;\u5b8c\u6574\u5b9e\u73b0\u4e86\u8fd9\u4e00\u903b\u8f91&#xff1a;<\/p>\n<p>def get_well_known_url(issuer, external&#061;False, suffix&#061;&#034;oauth-authorization-server&#034;):<br \/>\n    parsed &#061; urlparse.urlparse(issuer)<br \/>\n    path &#061; parsed.path<br \/>\n    if path and path !&#061; &#034;\/&#034;:<br \/>\n        url_path &#061; f&#034;\/.well-known\/{suffix}{path}&#034;<br \/>\n    else:<br \/>\n        url_path &#061; f&#034;\/.well-known\/{suffix}&#034;<br \/>\n    if not external:<br \/>\n        return url_path<br \/>\n    return parsed.scheme &#043; &#034;:\/\/&#034; &#043; parsed.netloc &#043; url_path<\/p>\n<p>\u53c2\u6570\u542b\u4e49&#xff1a;<\/p>\n<ul>\n<li>issuer&#xff1a;\u6388\u6743\u670d\u52a1\u5668\u7684\u7b7e\u53d1\u8005 URL&#xff1b;<\/li>\n<li>external&#xff1a;\u4e3a False&#xff08;\u9ed8\u8ba4&#xff09;\u65f6\u53ea\u8fd4\u56de\u8def\u5f84\u90e8\u5206&#xff08;\u5982 \/.well-known\/oauth-authorization-server&#xff0c;\u9002\u5408\u62fc\u63a5\u5728\u81ea\u5df1\u670d\u52a1\u7684\u8def\u7531\u4e0a&#xff09;&#xff1b;\u4e3a True \u65f6\u8fd4\u56de\u5b8c\u6574\u5916\u90e8 URL&#xff08;https:\/\/host\/.well-known\/oauth-authorization-server&#xff09;&#xff1b;<\/li>\n<li>suffix&#xff1a;well-known \u540e\u7f00&#xff0c;\u9ed8\u8ba4 oauth-authorization-server&#xff08;RFC 8414&#xff09;&#xff0c;\u53ef\u4f20\u5165\u5176\u4ed6\u503c\u590d\u7528\u540c\u4e00\u51fd\u6570\u2014\u2014\u4f8b\u5982\u4f20 openid-configuration \u5373\u53ef\u751f\u6210 OpenID Connect Discovery \u7684\u914d\u7f6e URL\u3002<\/li>\n<\/ul>\n<p>\u8fb9\u754c\u884c\u4e3a\u5728 test_rfc8414.py \u4e2d\u6709\u660e\u786e\u9a8c\u8bc1&#xff1a;<\/p>\n<ul>\n<li>https:\/\/provider.test \u4e0e https:\/\/provider.test\/&#xff08;\u5e26\u6839\u659c\u6760&#xff09;\u90fd\u5f97\u5230 \/.well-known\/oauth-authorization-server&#xff1b;<\/li>\n<li>\u5e26\u8def\u5f84\u7684 issuer \u4f1a\u8ffd\u52a0\u5230\u540e\u7f00\u4e4b\u540e&#xff1a;https:\/\/provider.test\/issuer1 \u2192 \/.well-known\/oauth-authorization-server\/issuer1&#xff0c;\u591a\u7ea7\u8def\u5f84 https:\/\/provider.test\/a\/b\/c \u540c\u6837\u9012\u5f52\u62fc\u63a5&#xff1b;<\/li>\n<li>external&#061;True \u65f6\u8fd4\u56de https:\/\/provider.test\/.well-known\/oauth-authorization-server&#xff1b;<\/li>\n<li>\u4fee\u6539 suffix&#061;&#034;openid-configuration&#034; \u65f6\u8fd4\u56de \/.well-known\/openid-configuration\u3002<\/li>\n<\/ul>\n<p>\u5bf9\u7167\u4e4b\u4e0b&#xff0c;OpenID Connect Discovery \u7684 get_well_known_url \u5b9e\u73b0\u7565\u6709\u4e0d\u540c&#xff08;\u540e\u7f00\u56fa\u5b9a\u4e3a openid-configuration \u4e14\u62fc\u63a5\u89c4\u5219\u4e3a path &#043; &#034;\/.well-known\/&#8230;&#034;&#xff09;&#xff0c;\u4e24\u8005\u4e0d\u53ef\u6df7\u7528\u2014\u2014RFC 8414 \u7684 URL \u62fc\u63a5\u5fc5\u987b\u8d70 rfc8414 \u6a21\u5757\u81ea\u5df1\u7684\u51fd\u6570\u3002<\/p>\n<h3>\u6269\u5c55\u673a\u5236&#xff1a;\u7528 metadata_classes \u7ec4\u5408 RFC 9101\u3001RFC 9207 \u4e0e OIDC Discovery<\/h3>\n<p>RFC 8414 \u7684\u5143\u6570\u636e\u6a21\u578b\u88ab\u8bbe\u8ba1\u4e3a\u53ef\u6269\u5c55\u7684\u3002validate() \u65b9\u6cd5\u63a5\u53d7 metadata_classes \u53c2\u6570&#xff08;\u89c1 models.py&#xff09;&#xff1a;\u5728\u5b8c\u6210\u81ea\u8eab 22 \u4e2a\u6807\u51c6\u5b57\u6bb5\u7684\u6821\u9a8c\u540e&#xff0c;\u4f1a\u4f9d\u6b21\u5b9e\u4f8b\u5316\u4f20\u5165\u7684\u6269\u5c55\u7c7b&#xff0c;\u5e76\u5bf9\u6269\u5c55\u7c7b\u5404\u81ea\u7684 REGISTRY_KEYS \u9010\u4e00\u8c03\u7528\u5176 validate_&lt;key&gt; \u65b9\u6cd5\u3002\u6821\u9a8c\u5931\u8d25\u7684\u5b57\u6bb5\u4f1a\u50cf\u6807\u51c6\u5b57\u6bb5\u4e00\u6837\u629b\u51fa ValueError\u3002<\/p>\n<p>\u7c7b docstring \u4e2d\u7684\u5b98\u65b9\u793a\u4f8b\u5c55\u793a\u4e86\u5982\u4f55\u53e0\u52a0 RFC 9101&#xff08;JWT Secured Authorization Request&#xff0c;JAR&#xff09;\u7684\u6269\u5c55\u5b57\u6bb5&#xff1a;<\/p>\n<p>from authlib.oauth2 import rfc8414, rfc9101<\/p>\n<p>metadata &#061; rfc8414.AuthorizationServerMetadata(data)<br \/>\nmetadata.validate(metadata_classes&#061;[rfc9101.AuthorizationServerMetadata])<\/p>\n<p>\u5176\u4e2d rfc9101.discovery \u7684\u6269\u5c55\u7c7b\u53ea\u5b9a\u4e49\u4e86 REGISTRY_KEYS &#061; [&#034;require_signed_request_object&#034;] \u4e00\u4e2a\u5b57\u6bb5&#xff0c;\u5e76\u590d\u7528 rfc8414.models \u5bfc\u51fa\u7684 validate_boolean_value \u6765\u6821\u9a8c\u8be5\u5e03\u5c14\u503c\u3002\u540c\u7406&#xff0c;rfc9207.discovery \u4e5f\u91c7\u7528\u4e86\u5b8c\u5168\u76f8\u540c\u7684\u7ec4\u5408\u6a21\u5f0f&#xff08;metadata.validate(metadata_classes&#061;[rfc9207.AuthorizationServerMetadata])&#xff09;&#xff0c;\u4e3a\u5143\u6570\u636e\u8ffd\u52a0 iss \u53c2\u6570\u76f8\u5173\u7684\u80fd\u529b\u58f0\u660e\u3002<\/p>\n<p>\u6d4b\u8bd5 test_validate_with_metadata_classes \u9a8c\u8bc1\u4e86\u8fd9\u6761\u94fe\u8def&#xff1a;\u5f53\u5143\u6570\u636e\u540c\u65f6\u643a\u5e26 require_signed_request_object: True \u4e14\u63d0\u4f9b\u57fa\u7840\u56db\u5b57\u6bb5&#xff08;issuer\u3001authorization_endpoint\u3001token_endpoint\u3001response_types_supported&#xff09;\u65f6\u6821\u9a8c\u901a\u8fc7&#xff1b;\u5f53\u8be5\u5b57\u6bb5\u88ab\u9519\u8bef\u5730\u8d4b\u503c\u4e3a\u5b57\u7b26\u4e32 &#034;invalid&#034; \u65f6&#xff0c;\u6269\u5c55\u6821\u9a8c\u4f1a\u629b\u51fa ValueError(&#039;&#8230; MUST be boolean&#039;)\u3002<\/p>\n<p>\u66f4\u5178\u578b\u7684\u7ee7\u627f\u5173\u7cfb\u53d1\u751f\u5728 OpenID Connect \u4e00\u4fa7&#xff1a;OpenIDProviderMetadata \u76f4\u63a5\u7ee7\u627f\u81ea AuthorizationServerMetadata&#xff0c;\u5728\u5176 REGISTRY_KEYS \u4e2d\u4fdd\u7559 RFC 8414 \u7684\u6838\u5fc3\u5b57\u6bb5&#xff0c;\u540c\u65f6\u8ffd\u52a0 subject_types_supported\u3001id_token_signing_alg_values_supported&#xff08;\u5f3a\u5236\u8981\u6c42\u5305\u542b RS256&#xff09;\u3001userinfo_*\u3001request_object_*\u3001claims_* \u7b49 OpenID \u6269\u5c55\u5b57\u6bb5&#xff0c;\u5e76\u590d\u7528\u4e86 rfc8414.models \u4e2d\u7684 validate_array_value\u3001validate_boolean_value\u3001validate_language_tags_array \u4e09\u4e2a\u8f85\u52a9\u51fd\u6570\u3002\u8fd9\u8bf4\u660e\u4e86 RFC 8414 \u6a21\u578b\u5728\u6574\u4e2a Authlib \u5143\u6570\u636e\u4f53\u7cfb\u4e2d\u7684\u57fa\u7840\u5730\u4f4d&#xff1a;OAuth 2.0 \u5c42\u9762\u7684\u5143\u6570\u636e\u6821\u9a8c\u903b\u8f91\u88ab OpenID Connect Discovery \u5b8c\u6574\u590d\u7528\u3002<\/p>\n<h3>\u5728\u8d44\u6e90\u670d\u52a1\u5668\u4e2d\u4f7f\u7528\u5143\u6570\u636e&#xff1a;\u4ece jwks_uri \u52a8\u6001\u83b7\u53d6\u7b7e\u540d\u5bc6\u94a5<\/h3>\n<p>RFC 8414 \u5143\u6570\u636e\u5728 Authlib \u4e2d\u7684\u5b9e\u9645\u6d88\u8d39\u573a\u666f\u4e4b\u4e00\u662f RFC 9068&#xff08;JWT Access Token&#xff09;\u8d44\u6e90\u670d\u52a1\u5668\u3002\u5728 rfc9068\/token_validator.py \u4e2d&#xff0c;JwtBearerTokenValidator \u8981\u6c42\u5f00\u53d1\u8005\u5b9e\u73b0 get_jwks() \u65b9\u6cd5\u6765\u63d0\u4f9b\u9a8c\u7b7e\u5bc6\u94a5&#xff0c;\u5176 docstring \u660e\u786e\u63a8\u8350\u501f\u52a9 RFC 8414 \u5143\u6570\u636e\u52a8\u6001\u83b7\u53d6\u5e76\u7f13\u5b58&#xff1a;<\/p>\n<p>def get_jwks(self):<br \/>\n    if &#034;jwks&#034; in cache:<br \/>\n        return cache.get(&#034;jwks&#034;)<\/p>\n<p>    server_metadata &#061; get_server_metadata(self.issuer)  # \u5373 \/.well-known\/oauth-authorization-server \u8fd4\u56de\u7684\u5143\u6570\u636e<br \/>\n    jwks_uri &#061; server_metadata.get(&#034;jwks_uri&#034;)<br \/>\n    cache[&#034;jwks&#034;] &#061; requests.get(jwks_uri).json()<br \/>\n    return cache[&#034;jwks&#034;]<\/p>\n<p>\u540c\u65f6&#xff0c;\u8be5\u9a8c\u8bc1\u5668\u8fd8\u4f1a\u7528\u6784\u9020\u65f6\u4f20\u5165\u7684 issuer \u4e0e JWT \u4e2d\u7684 iss \u58f0\u660e\u505a\u7cbe\u786e\u6bd4\u5bf9&#xff08;validate_iss&#xff0c;\u89c1 token_validator.py&#xff09;&#xff0c;\u8fd9\u6b63\u662f RFC 8414 \u5143\u6570\u636e\u4e2d issuer \u5b57\u6bb5\u7684\u6838\u5fc3\u7ea6\u675f\u5728\u5ba2\u6237\u7aef\u4fa7\u7684\u4f53\u73b0&#xff1a;\u5ba2\u6237\u7aef\u4ece\u5143\u6570\u636e\u62ff\u5230\u7684 issuer \u5fc5\u987b\u4e0e\u4ee4\u724c\u4e2d\u7684 iss \u5b8c\u5168\u4e00\u81f4\u3002<\/p>\n<p>\u5728 Authlib \u7684 Web \u5ba2\u6237\u7aef\u96c6\u6210\u4e2d&#xff0c;\u5143\u6570\u636e\u9a71\u52a8\u7684\u81ea\u52a8\u53d1\u73b0\u540c\u6837\u662f\u4e00\u7b49\u516c\u6c11&#xff1a;OAuth.register \u652f\u6301 server_metadata_url \u914d\u7f6e&#xff08;\u89c1 base_client\/registry.py&#xff09;&#xff0c;load_server_metadata() \u65b9\u6cd5\u4f1a\u60f0\u6027\u62c9\u53d6\u8be5 URL \u7684 JSON \u5e76\u5199\u5165 server_metadata&#xff08;\u89c1 sync_app.py&#xff09;&#xff0c;\u968f\u540e authorization_endpoint\u3001token_endpoint\u3001jwks_uri \u7b49\u5747\u4ece\u5143\u6570\u636e\u4e2d\u53d6\u503c&#xff0c;\u5b9e\u73b0\u4e86&#034;\u53ea\u914d\u4e00\u4e2a server_metadata_url \u5373\u53ef\u63a5\u5165\u6388\u6743\u670d\u52a1\u5668&#034;\u7684\u96f6\u914d\u7f6e\u4f53\u9a8c\u3002<\/p>\n<h3>\u603b\u7ed3<\/h3>\n<p>Authlib \u7684 authlib.oauth2.rfc8414 \u6a21\u5757\u662f\u5bf9 RFC 8414 \u7684\u5b8c\u6574\u3001\u53ef\u6269\u5c55\u5b9e\u73b0&#xff1a;<\/p>\n<ul>\n<li>\u6a21\u578b\u5c42&#xff1a;AuthorizationServerMetadata&#xff08;\u7ee7\u627f dict&#xff09;\u8986\u76d6\u5168\u90e8 22 \u4e2a\u6807\u51c6\u5143\u6570\u636e\u5b57\u6bb5&#xff0c;\u9010\u5b57\u6bb5\u5b9e\u73b0\u4e86 REQUIRED \/ OPTIONAL \/ RECOMMENDED \u4e0e\u9ed8\u8ba4\u503c\u8bed\u4e49&#xff0c;\u5e76\u5bf9 https \u5f3a\u5236\u8981\u6c42\u3001query\/fragment \u7981\u7528\u3001JSON \u6570\u7ec4\u7c7b\u578b\u3001BCP 47 \u8bed\u8a00\u6807\u7b7e\u3001JWT \u8ba4\u8bc1\u7b97\u6cd5\u4ea4\u53c9\u7ea6\u675f\u7b49\u7ec6\u5219\u505a\u4e86\u4e25\u683c\u6821\u9a8c&#xff1b;<\/li>\n<li>\u5de5\u5177\u5c42&#xff1a;get_well_known_url \u4f9d\u636e Section 3.1 \u8ba1\u7b97 well-known URL&#xff0c;\u652f\u6301\u8def\u5f84\u8ffd\u52a0\u3001\u5916\u90e8 URL \u8f93\u51fa\u4e0e\u81ea\u5b9a\u4e49\u540e\u7f00&#xff1b;<\/li>\n<li>\u6269\u5c55\u5c42&#xff1a;validate(metadata_classes&#061;&#8230;) \u7ec4\u5408\u673a\u5236\u4f7f RFC 9101\u3001RFC 9207 \u7b49\u65b0\u7279\u6027\u53ef\u4ee5\u96f6\u4fb5\u5165\u5730\u53e0\u52a0\u6821\u9a8c&#xff0c;OpenID Connect Discovery \u7684 OpenIDProviderMetadata \u66f4\u662f\u76f4\u63a5\u7ee7\u627f\u672c\u6a21\u5757&#xff0c;\u590d\u7528\u5176\u8f85\u52a9\u6821\u9a8c\u51fd\u6570&#xff1b;<\/li>\n<li>\u5e94\u7528\u5c42&#xff1a;\u8d44\u6e90\u670d\u52a1\u5668\u53ef\u501f\u52a9 jwks_uri \u52a8\u6001\u62c9\u53d6\u5e76\u7f13\u5b58\u9a8c\u7b7e\u5bc6\u94a5&#xff0c;Web \u5ba2\u6237\u7aef\u53ef\u901a\u8fc7 server_metadata_url \u81ea\u52a8\u53d1\u73b0\u5168\u90e8\u7aef\u70b9\u3002<\/li>\n<\/ul>\n<p>\u5982\u9700\u6df1\u5165\u9a8c\u8bc1\u5404\u5b57\u6bb5\u7684\u8fb9\u754c\u884c\u4e3a&#xff0c;\u53ef\u76f4\u63a5\u9605\u8bfb test_rfc8414.py \u4e2d\u7684 20 \u4f59\u4e2a\u9488\u5bf9\u6027\u6d4b\u8bd5\u7528\u4f8b&#xff1b;\u82e5\u8981\u4e86\u89e3\u5b83\u4e0e OpenID Connect Discovery \u7684\u7ee7\u627f\u5173\u7cfb&#xff0c;\u53ef\u5bf9\u7167 oidc\/discovery\/models.py\u3002<\/p>\n<p>  <img loading=\"lazy\" decoding=\"async\" class=\"gcb-icon-like\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261013042510-6acdb2a6af235.svg\" alt=\"\" width=\"16\" height=\"16\" \/> <span class=\"gcb-like-text\">\u8d5e<\/span>  <\/p>\n<p>   <span class=\"gcb-share-text\">\u5206\u4eab<\/span>  <\/p>\n<h3 class=\"gcb-project-title\">\u3010\u514d\u8d39\u4e0b\u8f7d\u94fe\u63a5\u3011authlib<\/h3>\n<p class=\"gcb-project-desc\">The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.<\/p>\n<p>    <span class=\"gcb-project-addr-label\">\u9879\u76ee\u5730\u5740&#xff1a;<\/span><br \/>\n    <span class=\"gcb-project-addr-link\">https:\/\/gitcode.com\/gh_mirrors\/au\/authlib<\/span> <\/p>\n<p>  <span class=\"gcb-project-btn\"> <span class=\"gcb-project-btn-main\">\u70b9\u51fb\u67e5\u770b<\/span> <span class=\"gcb-project-btn-sub\">\u514d\u8d39\u4e0b\u8f7d<\/span> <\/span> <\/p>\n<h4 class=\"gcb-related-title\">\u76f8\u5173\u63a8\u8350<\/h4>\n<ul class=\"gcb-related-list\">\n<li class=\"gcb-related-item\">\n<h5 class=\"gcb-related-item-title\">WPScan \u63d2\u4ef6\u7248\u672c\u8bc6\u522b\u5b9e\u6218&#xff1a;\u4ee5 Chaport \u7684 changelog.md \u4e3a\u6837\u672c&#xff0c;\u7406\u89e3 ChangeLog \u52a8\u6001\u67e5\u627e\u5668\u7684\u5de5\u4f5c\u673a\u5236<\/h5>\n<p class=\"gcb-related-item-desc\">WPScan \u63d2\u4ef6\u7248\u672c\u8bc6\u522b\u5b9e\u6218&#xff1a;\u4ee5 Chaport \u7684 changelog.md \u4e3a\u6837\u672c&#xff0c;\u7406\u89e3 ChangeLog \u52a8\u6001\u67e5\u627e\u5668\u7684\u5de5\u4f5c\u673a\u5236 \u5bfc\u8bfb \u672c\u6587\u4ee5\u4ed3\u5e93\u4e2d c<\/p>\n<\/li>\n<li class=\"gcb-related-item\">\n<h5 class=\"gcb-related-item-title\"> Spring Authorization Server \u7ec8\u6781\u6307\u5357&#xff1a;\u6df1\u5165\u7406\u89e3 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u67b6\u6784\u4e0e\u5b9e\u73b0\u539f\u7406<\/h5>\n<p class=\"gcb-related-item-desc\">Spring Authorization Server \u7ec8\u6781\u6307\u5357&#xff1a;\u6df1\u5165\u7406\u89e3 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u67b6\u6784\u4e0e\u5b9e\u73b0\u539f\u7406 Spring Authorizatio<\/p>\n<p>     <span class=\"gcb-tag\">\u540e\u7aef<\/span><br \/>\n     <span class=\"gcb-tag\">\u8ba4\u8bc1\u9274\u6743<\/span>\n      <\/li>\n<li class=\"gcb-related-item\">\n<h5 class=\"gcb-related-item-title\">NginxWebUI\u96c6\u7fa4\u7ba1\u7406\u79d8\u7c4d&#xff1a;\u7edf\u4e00\u914d\u7f6e\u591a\u53f0Nginx\u670d\u52a1\u5668<\/h5>\n<p class=\"gcb-related-item-desc\">NginxWebUI\u96c6\u7fa4\u7ba1\u7406\u79d8\u7c4d&#xff1a;\u7edf\u4e00\u914d\u7f6e\u591a\u53f0Nginx\u670d\u52a1\u5668 NginxWebUI\u662f\u4e00\u6b3e\u529f\u80fd\u5f3a\u5927\u7684Nginx\u7f51\u9875\u7ba1\u7406\u5de5\u5177&#xff0c;\u80fd\u591f\u5e2e\u52a9\u7528\u6237\u901a\u8fc7\u76f4\u89c2\u7684\u7f51\u9875\u754c\u9762\u5feb\u901f\u914d<\/p>\n<p>     <span class=\"gcb-tag\">\u540e\u7aef<\/span><br \/>\n     <span class=\"gcb-tag\">\u8fd0\u7ef4<\/span>\n      <\/li>\n<\/ul>\n<p>  <span class=\"gcb-prev-next-label\">\u4e0a\u4e00\u7bc7&#xff1a;<\/span><br \/>\n  LangChain Next.js\u6a21\u677f\u7684RAG\u5b9e\u73b0&#xff1a;\u6784\u5efa\u667a\u80fd\u68c0\u7d22\u7cfb\u7edf\u7684\u7ec8\u6781\u6307\u5357 <\/p>\n<p>  <span class=\"gcb-prev-next-label\">\u4e0b\u4e00\u7bc7&#xff1a;<\/span><br \/>\n  Rust \u7f16\u8bd1\u5668\u9519\u8bef E0508 \u6df1\u5ea6\u89e3\u6790&#xff1a;\u65e0\u6cd5\u4ece\u975e Copy \u5b9a\u957f\u6570\u7ec4\u79fb\u51fa\u503c&#xff08;cannot move out of type &#8230; non-copy fixed-size array&#xff09; <\/p>\n<p>\u521b\u4f5c\u58f0\u660e\uff1a\u672c\u6587\u90e8\u5206\u5185\u5bb9\u7531AI\u8f85\u52a9\u751f\u6210\uff08AIGC\uff09\uff0c\u4ec5\u4f9b\u53c2\u8003<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u3010\u514d\u8d39\u4e0b\u8f7d\u94fe\u63a5\u3011authlib The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included. \u9879\u76ee\u5730\u5740&#xff1a; https:\/\/gitcode.com\/gh_mirrors\/au\/authlib \u70b9\u51fb\u67e5\u770b \u514d\u8d39\u4e0b\u8f7d  RFC 8414&#xff08;OAuth 2.0 Authorization S<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"topic":[],"class_list":["post-115805","post","type-post","status-publish","format-standard","hentry","category-server"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/115805.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u3010\u514d\u8d39\u4e0b\u8f7d\u94fe\u63a5\u3011authlib The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included. \u9879\u76ee\u5730\u5740&#xff1a; https:\/\/gitcode.com\/gh_mirrors\/au\/authlib \u70b9\u51fb\u67e5\u770b \u514d\u8d39\u4e0b\u8f7d RFC 8414&#xff08;OAuth 2.0 Authorization S\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/115805.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-13T04:25:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261013042510-6acdb2a6af235.svg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/115805.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/115805.html\",\"name\":\"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-10-13T04:25:11+00:00\",\"dateModified\":\"2026-10-13T04:25:11+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/115805.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/115805.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/115805.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/115805.html","og_locale":"zh_CN","og_type":"article","og_title":"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u3010\u514d\u8d39\u4e0b\u8f7d\u94fe\u63a5\u3011authlib The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included. \u9879\u76ee\u5730\u5740&#xff1a; https:\/\/gitcode.com\/gh_mirrors\/au\/authlib \u70b9\u51fb\u67e5\u770b \u514d\u8d39\u4e0b\u8f7d RFC 8414&#xff08;OAuth 2.0 Authorization S","og_url":"https:\/\/www.wsisp.com\/helps\/115805.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-10-13T04:25:11+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261013042510-6acdb2a6af235.svg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"8 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/115805.html","url":"https:\/\/www.wsisp.com\/helps\/115805.html","name":"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-10-13T04:25:11+00:00","dateModified":"2026-10-13T04:25:11+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/115805.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/115805.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/115805.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Authlib \u4e2d RFC 8414 OAuth 2.0 \u6388\u6743\u670d\u52a1\u5668\u5143\u6570\u636e\uff08Authorization Server Metadata\uff09\u5b8c\u6574\u6307\u5357"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/115805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=115805"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/115805\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=115805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=115805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=115805"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=115805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}