OAuth2 Client:令牌的获取、刷新与存放

  跳转链:302 客户端 /oauth2/authorization/demo → 302 9601/oauth2/authorize → 200 9601/login → 302 AS POST /login → 302 9601/oauth2/authorize → 302 9602/login/oauth2/code/demo → 404 9602/
  客户端发给授权服务器的授权请求参数:{'response_type': 'code', 'client_id': 'conf', 'scope': 'openid read', 'state': 'nDnzZEqG13jVoncmzmim…', 'redirect_uri': 'http://127.0.0.1:960…', 'nonce': 'UYumkDfyeEHXldQlGWK0…', 'code_challenge': 'K1zN3ogsYqEAUg7r0iku…', 'code_challenge_method': 'S256'}
  GET /me → HTTP 200 principal 类型=DefaultOidcUser,name=alice,authorities=[OIDC_USER, SCOPE_openid, SCOPE_read],id_token 的 claims 键=[aud, auth_time, azp, exp, iat, iss, jti, nonce, sid, sub]
  GET /sess → session 属性 [SPRING_SECURITY_CONTEXT]
  GET /store → OAuth2AuthorizedClientRepository = AuthenticatedPrincipalOAuth2AuthorizedClientRepository;OAuth2AuthorizedClientService = [InMemoryOAuth2AuthorizedClientService]

  登录完立刻 GET /token → HTTP 200 access_token 前 12 位=eyJraWQiOiJj…末 8 位=ydBmflQw,签发=2026-10-20T04:28:37.977370Z,过期=2026-10-20T04:29:38.977370Z,scopes=[openid, read],refresh_token=有
  等 4 秒(access token 的有效期是 62 秒,客户端提前 60 秒就认为快过期了)……
  再 GET /token → HTTP 200 access_token 前 12 位=eyJraWQiOiJj…末 8 位=AzmfkcoA,签发=2026-10-20T04:28:42.173767Z,过期=2026-10-20T04:29:43.173767Z,scopes=[openid, read],refresh_token=有
  两次的 access_token 末 8 位:ydBmflQw 与 AzmfkcoA,不同(用 refresh_token 换了新的)

  带着重启之前的 JSESSIONID GET /token → HTTP 302,Location http://127.0.0.1:9602/oauth2/authorization/demo