# 服务端返回 401，告知需要认证
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="My Application"

# 客户端发送凭据（Base64 编码的 username:password）
GET /api/data HTTP/1.1
Authorization: Basic dXNlcjpwYXNzd29yZA==

import requests
from requests.auth import HTTPBasicAuth

# 方式 1：使用 HTTPBasicAuth
response = requests.get(
    'https://api.example.com/data',
    auth=HTTPBasicAuth('username', 'password')
)

# 方式 2：使用元组简写
response = requests.get(
    'https://api.example.com/data',
    auth=('username', 'password')
)

# 方式 3：手动构建 Header
import base64
credentials = base64.b64encode(b'username:password').decode()
response = requests.get(
    'https://api.example.com/data',
    headers={'Authorization': f'Basic {credentials}'}
)

# curl Basic 认证
curl -u username:password https://api.example.com/data

# 或者
curl -H "Authorization: Basic $(echo -n 'user:pass' | base64)" https://api.example.com/data

const express = require('express');
const app = express();

function basicAuth(req, res, next) {
    const authHeader = req.headers.authorization;
    
    if (!authHeader || !authHeader.startsWith('Basic ')) {
        res.setHeader('WWW-Authenticate', 'Basic realm="My Application"');
        return res.status(401).json({ error: '请提供认证凭据' });
    }
    
    const credentials = Buffer.from(authHeader.slice(6), 'base64').toString();
    const [username, password] = credentials.split(':');
    
    if (username === 'admin' && password === 'secret') {
        req.user = { username };
        next();
    } else {
        res.setHeader('WWW-Authenticate', 'Basic realm="My Application"');
        return res.status(401).json({ error: '凭据无效' });
    }
}

app.get('/api/admin', basicAuth, (req, res) => {
    res.json({ message: `欢迎，${req.user.username}` });
});

GET /api/users HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

const jwt = require('jsonwebtoken');

const ACCESS_SECRET = 'access-secret-key';
const REFRESH_SECRET = 'refresh-secret-key';

// 登录
app.post('/api/login', async (req, res) => {
    const { email, password } = req.body;
    const user = await findUser(email);
    
    if (!user || !await verifyPassword(password, user.hash)) {
        return res.status(401).json({ error: '邮箱或密码错误' });
    }
    
    const accessToken = jwt.sign(
        { sub: user.id, email: user.email, role: user.role },
        ACCESS_SECRET,
        { expiresIn: '1h' }
    );
    
    const refreshToken = jwt.sign(
        { sub: user.id },
        REFRESH_SECRET,
        { expiresIn: '7d' }
    );
    
    await storeRefreshToken(user.id, refreshToken);
    
    res.json({
        access_token: accessToken,
        refresh_token: refreshToken,
        expires_in: 3600,
        token_type: 'Bearer'
    });
});

// 刷新 Token
app.post('/api/refresh', async (req, res) => {
    const { refresh_token } = req.body;
    
    try {
        const payload = jwt.verify(refresh_token, REFRESH_SECRET);
        const stored = await getRefreshToken(payload.sub);
        
        if (stored !== refresh_token) {
            return res.status(401).json({ error: '无效的刷新令牌' });
        }
        
        const newAccessToken = jwt.sign(
            { sub: payload.sub },
            ACCESS_SECRET,
            { expiresIn: '1h' }
        );
        
        res.json({
            access_token: newAccessToken,
            expires_in: 3600,
            token_type: 'Bearer'
        });
    } catch (err) {
        res.status(401).json({ error: '刷新令牌已过期，请重新登录' });
    }
});

// 认证中间件
function authenticate(req, res, next) {
    const authHeader = req.headers.authorization;
    
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
        return res.status(401).json({ error: '请提供认证令牌' });
    }
    
    const token = authHeader.slice(7);
    
    try {
        const payload = jwt.verify(token, ACCESS_SECRET);
        req.user = payload;
        next();
    } catch (err) {
        if (err.name === 'TokenExpiredError') {
            return res.status(401).json({ error: '令牌已过期', code: 'TOKEN_EXPIRED' });
        }
        return res.status(401).json({ error: '无效的令牌' });
    }
}

// Python JWT 示例
const jwt = require('jsonwebtoken');

// 签发 Token
const token = jwt.sign(
    {
        sub: '12345',
        email: '[email protected]',
        role: 'admin'
    },
    'secret-key',
    {
        algorithm: 'HS256',
        expiresIn: '1h',
        issuer: 'api.example.com'
    }
);

console.log(token);
// eyJhbGciOiJIUzI1NiIs...

// 验证 Token
try {
    const payload = jwt.verify(token, 'secret-key', {
        algorithms: ['HS256'],
        issuer: 'api.example.com'
    });
    console.log(payload);
    // { sub: '12345', email: '[email protected]', role: 'admin', iat: ..., exp: ... }
} catch (err) {
    console.error('Token 无效:', err.message);
}

// 使用 passport.js 实现 OAuth2
const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(new GoogleStrategy({
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/auth/google/callback'
}, (accessToken, refreshToken, profile, done) => {
    // 查找或创建用户
    User.findOrCreate({ googleId: profile.id }, (err, user) => {
        return done(err, user);
    });
}));

// 路由
app.get('/auth/google', passport.authenticate('google', {
    scope: ['profile', 'email']
}));

app.get('/auth/google/callback',
    passport.authenticate('google', { failureRedirect: '/login' }),
    (req, res) => {
        res.redirect('/');
    }
);

# 方式 1：查询参数
curl "https://api.example.com/data?api_key=YOUR_API_KEY"

# 方式 2：自定义头部
curl -H "X-API-Key: YOUR_API_KEY" https://api.example.com/data

# 方式 3：Authorization 头
curl -H "Authorization: ApiKey YOUR_API_KEY" https://api.example.com/data

const crypto = require('crypto');

// 生成 API Key
function generateApiKey() {
    return `pk_${crypto.randomBytes(32).toString('hex')}`;
}

// API Key 验证中间件
async function apiKeyAuth(req, res, next) {
    const apiKey = req.headers['x-api-key'] || req.query.api_key;
    
    if (!apiKey) {
        return res.status(401).json({
            error: { code: 'MISSING_API_KEY', message: '请提供 API Key' }
        });
    }
    
    const keyRecord = await findApiKey(apiKey);
    if (!keyRecord) {
        return res.status(401).json({
            error: { code: 'INVALID_API_KEY', message: 'API Key 无效' }
        });
    }
    
    if (keyRecord.expires_at && new Date(keyRecord.expires_at) < new Date()) {
        return res.status(401).json({
            error: { code: 'API_KEY_EXPIRED', message: 'API Key 已过期' }
        });
    }
    
    req.apiKey = keyRecord;
    next();
}

// 路由级别的不同认证策略
const express = require('express');
const app = express();

// 公开路由 — 无需认证
app.get('/api/public/products', (req, res) => {
    res.json({ products: [...] });
});

// API Key 认证 — 第三方集成
app.get('/api/v1/external', apiKeyAuth, (req, res) => {
    res.json({ data: [...] });
});

// JWT 认证 — 前端应用
app.get('/api/users/me', jwtAuth, (req, res) => {
    res.json({ user: req.user });
});

// 角色授权 — 管理员
app.get('/api/admin/users', jwtAuth, requireRole('admin'), (req, res) => {
    res.json({ users: [...] });
});