OAuth 2.0과 JWT는 현대적인 웹 애플리케이션의 인증/인가 시스템의 핵심이다. 이 글은 OAuth 2.0의 다양한 플로우와 JWT의 생성/검증을 실전 예제와 함께 정리한다.
\nOAuth 2.0은 제3자 애플리케이션에게 제한된 리소스 접근 권한을 부여하는 인가 프레임워크다.
\n주요 역할:
\nfrom flask import Flask, redirect, request, session\nimport requests\nimport secrets\n\napp = Flask(__name__)\napp.secret_key = secrets.token_hex(16)\n\n# OAuth 2.0 설정\nCLIENT_ID = \"your-client-id\"\nCLIENT_SECRET = \"your-client-secret\"\nREDIRECT_URI = \"http://localhost:5000/callback\"\nAUTHORIZATION_URL = \"https://oauth-provider.com/authorize\"\nTOKEN_URL = \"https://oauth-provider.com/token\"\n\n@app.route(\"/login\")\ndef login():\n # 1. Authorization Code 요청\n state = secrets.token_urlsafe(32)\n session['oauth_state'] = state\n \n params = {\n \"response_type\": \"code\",\n \"client_id\": CLIENT_ID,\n \"redirect_uri\": REDIRECT_URI,\n \"scope\": \"read write\",\n \"state\": state\n }\n \n auth_url = f\"{AUTHORIZATION_URL}?{requests.compat.urlencode(params)}\"\n return redirect(auth_url)\n\n@app.route(\"/callback\")\ndef callback():\n # 2. Authorization Code 수신\n code = request.args.get(\"code\")\n state = request.args.get(\"state\")\n \n # State 검증 (CSRF 방지)\n if state != session.get('oauth_state'):\n return \"Invalid state parameter\", 400\n \n # 3. Access Token 교환\n token_data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": REDIRECT_URI,\n \"client_id\": CLIENT_ID,\n \"client_secret\": CLIENT_SECRET\n }\n \n response = requests.post(TOKEN_URL, data=token_data)\n token_response = response.json()\n \n # 4. Access Token 저장\n session['access_token'] = token_response['access_token']\n session['refresh_token'] = token_response.get('refresh_token')\n \n return \"Login successful!\"\n\n@app.route(\"/api/data\")\ndef get_data():\n # 5. Access Token으로 리소스 접근\n access_token = session.get('access_token')\n if not access_token:\n return redirect(\"/login\")\n \n headers = {\"Authorization\": f\"Bearer {access_token}\"}\n response = requests.get(\"https://api.example.com/data\", headers=headers)\n \n return response.json()import hashlib\nimport base64\nimport secrets\n\ndef generate_code_verifier():\n \"\"\"Code Verifier 생성\"\"\"\n return base64.urlsafe_b64encode(secrets.token_bytes(32)).decode('utf-8').rstrip('=')\n\ndef generate_code_challenge(verifier):\n \"\"\"Code Challenge 생성 (SHA256)\"\"\"\n challenge = hashlib.sha256(verifier.encode('utf-8')).digest()\n return base64.urlsafe_b64encode(challenge).decode('utf-8').rstrip('=')\n\n@app.route(\"/login-pkce\")\ndef login_pkce():\n # PKCE를 사용한 안전한 Authorization Code Flow\n code_verifier = generate_code_verifier()\n code_challenge = generate_code_challenge(code_verifier)\n \n session['code_verifier'] = code_verifier\n state = secrets.token_urlsafe(32)\n session['oauth_state'] = state\n \n params = {\n \"response_type\": \"code\",\n \"client_id\": CLIENT_ID,\n \"redirect_uri\": REDIRECT_URI,\n \"scope\": \"read write\",\n \"state\": state,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\"\n }\n \n auth_url = f\"{AUTHORIZATION_URL}?{requests.compat.urlencode(params)}\"\n return redirect(auth_url)\n\n@app.route(\"/callback-pkce\")\ndef callback_pkce():\n code = request.args.get(\"code\")\n state = request.args.get(\"state\")\n \n if state != session.get('oauth_state'):\n return \"Invalid state\", 400\n \n # Code Verifier와 함께 토큰 요청\n token_data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": REDIRECT_URI,\n \"client_id\": CLIENT_ID,\n \"code_verifier\": session.get('code_verifier')\n }\n \n response = requests.post(TOKEN_URL, data=token_data)\n token_response = response.json()\n \n session['access_token'] = token_response['access_token']\n return \"Login successful!\"import requests\nfrom datetime import datetime, timedelta\n\nclass OAuth2Client:\n def __init__(self, client_id, client_secret, token_url):\n self.client_id = client_id\n self.client_secret = client_secret\n self.token_url = token_url\n self.access_token = None\n self.token_expires_at = None\n \n def get_access_token(self):\n \"\"\"Access Token 획득\"\"\"\n # 토큰이 유효하면 재사용\n if self.access_token and self.token_expires_at:\n if datetime.now() < self.token_expires_at:\n return self.access_token\n \n # 새 토큰 요청\n token_data = {\n \"grant_type\": \"client_credentials\",\n \"client_id\": self.client_id,\n \"client_secret\": self.client_secret,\n \"scope\": \"api:read api:write\"\n }\n \n response = requests.post(self.token_url, data=token_data)\n token_response = response.json()\n \n self.access_token = token_response['access_token']\n expires_in = token_response.get('expires_in', 3600)\n self.token_expires_at = datetime.now() + timedelta(seconds=expires_in)\n \n return self.access_token\n \n def make_authenticated_request(self, url, method='GET', **kwargs):\n \"\"\"인증된 요청\"\"\"\n token = self.get_access_token()\n headers = kwargs.get('headers', {})\n headers['Authorization'] = f\"Bearer {token}\"\n kwargs['headers'] = headers\n \n return requests.request(method, url, **kwargs)\n\n# 사용 예시\nclient = OAuth2Client(\n client_id=\"your-client-id\",\n client_secret=\"your-client-secret\",\n token_url=\"https://oauth-provider.com/token\"\n)\n\nresponse = client.make_authenticated_request(\"https://api.example.com/data\")\nprint(response.json())JWT는 세 부분으로 구성된다:
\nHeader.Payload.Signatureimport jwt\nfrom datetime import datetime, timedelta\nimport secrets\n\n# JWT 설정\nSECRET_KEY = secrets.token_urlsafe(32)\nALGORITHM = \"HS256\"\n\ndef create_access_token(data: dict, expires_delta: timedelta = None):\n \"\"\"Access Token 생성\"\"\"\n to_encode = data.copy()\n \n if expires_delta:\n expire = datetime.utcnow() + expires_delta\n else:\n expire = datetime.utcnow() + timedelta(minutes=15)\n \n to_encode.update({\n \"exp\": expire,\n \"iat\": datetime.utcnow(),\n \"type\": \"access\"\n })\n \n encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)\n return encoded_jwt\n\ndef create_refresh_token(data: dict):\n \"\"\"Refresh Token 생성\"\"\"\n to_encode = data.copy()\n expire = datetime.utcnow() + timedelta(days=30)\n \n to_encode.update({\n \"exp\": expire,\n \"iat\": datetime.utcnow(),\n \"type\": \"refresh\"\n })\n \n encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)\n return encoded_jwt\n\n# 사용 예시\nuser_data = {\n \"user_id\": 123,\n \"username\": \"alice\",\n \"email\": \"alice@example.com\",\n \"roles\": [\"user\", \"admin\"]\n}\n\naccess_token = create_access_token(user_data, expires_delta=timedelta(minutes=15))\nrefresh_token = create_refresh_token({\"user_id\": user_data[\"user_id\"]})\n\nprint(f\"Access Token: {access_token}\")\nprint(f\"Refresh Token: {refresh_token}\")from functools import wraps\nfrom flask import request, jsonify\n\ndef verify_token(token: str):\n \"\"\"JWT 토큰 검증\"\"\"\n try:\n payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])\n return payload\n except jwt.ExpiredSignatureError:\n return None # 토큰 만료\n except jwt.InvalidTokenError:\n return None # 유효하지 않은 토큰\n\ndef token_required(f):\n \"\"\"토큰 검증 데코레이터\"\"\"\n @wraps(f)\n def decorated(*args, **kwargs):\n token = None\n \n # Authorization 헤더에서 토큰 추출\n if 'Authorization' in request.headers:\n auth_header = request.headers['Authorization']\n try:\n token = auth_header.split(' ')[1] # \"Bearer <token>\"\n except IndexError:\n return jsonify({'message': 'Invalid token format'}), 401\n \n if not token:\n return jsonify({'message': 'Token is missing'}), 401\n \n # 토큰 검증\n payload = verify_token(token)\n if not payload:\n return jsonify({'message': 'Token is invalid or expired'}), 401\n \n # 요청에 사용자 정보 추가\n request.current_user = payload\n return f(*args, **kwargs)\n \n return decorated\n\n# 사용 예시\n@app.route(\"/api/protected\")\n@token_required\ndef protected_route():\n user = request.current_user\n return jsonify({\n 'message': 'Access granted',\n 'user_id': user['user_id'],\n 'username': user['username']\n })from cryptography.hazmat.primitives import serialization\nfrom cryptography.hazmat.primitives.asymmetric import rsa\nimport jwt\n\n# RSA 키 쌍 생성\nprivate_key = rsa.generate_private_key(\n public_exponent=65537,\n key_size=2048\n)\n\npublic_key = private_key.public_key()\n\n# Private Key를 PEM 형식으로 저장\nprivate_pem = private_key.private_bytes(\n encoding=serialization.Encoding.PEM,\n format=serialization.PrivateFormat.PKCS8,\n encryption_algorithm=serialization.NoEncryption()\n)\n\n# Public Key를 PEM 형식으로 저장\npublic_pem = public_key.public_bytes(\n encoding=serialization.Encoding.PEM,\n format=serialization.PublicFormat.SubjectPublicKeyInfo\n)\n\n# RS256으로 JWT 생성\ndef create_token_rs256(data: dict):\n \"\"\"RS256 알고리즘으로 JWT 생성\"\"\"\n token = jwt.encode(\n data,\n private_pem,\n algorithm=\"RS256\"\n )\n return token\n\n# RS256으로 JWT 검증\ndef verify_token_rs256(token: str):\n \"\"\"RS256 알고리즘으로 JWT 검증\"\"\"\n try:\n payload = jwt.decode(\n token,\n public_pem,\n algorithms=[\"RS256\"]\n )\n return payload\n except jwt.InvalidTokenError:\n return None\n\n# 사용 예시\nuser_data = {\"user_id\": 123, \"username\": \"alice\"}\ntoken = create_token_rs256(user_data)\npayload = verify_token_rs256(token)from flask import Flask, request, jsonify\nfrom datetime import datetime, timedelta\nimport jwt\n\napp = Flask(__name__)\n\n# 토큰 저장소 (실제로는 데이터베이스 사용)\ntoken_store = {}\n\ndef create_token_pair(user_data: dict):\n \"\"\"Access Token과 Refresh Token 쌍 생성\"\"\"\n access_token = create_access_token(\n user_data,\n expires_delta=timedelta(minutes=15)\n )\n \n refresh_token = create_refresh_token({\"user_id\": user_data[\"user_id\"]})\n \n # Refresh Token 저장\n token_store[refresh_token] = {\n \"user_id\": user_data[\"user_id\"],\n \"created_at\": datetime.utcnow()\n }\n \n return access_token, refresh_token\n\n@app.route(\"/api/refresh\", methods=[\"POST\"])\ndef refresh_token():\n \"\"\"Refresh Token으로 새 Access Token 발급\"\"\"\n data = request.get_json()\n refresh_token = data.get(\"refresh_token\")\n \n if not refresh_token:\n return jsonify({\"error\": \"Refresh token is required\"}), 400\n \n # Refresh Token 검증\n payload = verify_token(refresh_token)\n if not payload or payload.get(\"type\") != \"refresh\":\n return jsonify({\"error\": \"Invalid refresh token\"}), 401\n \n # Refresh Token이 저장소에 있는지 확인\n if refresh_token not in token_store:\n return jsonify({\"error\": \"Refresh token not found\"}), 401\n \n # 새 Access Token 생성\n user_id = payload[\"user_id\"]\n user_data = {\"user_id\": user_id} # 실제로는 DB에서 조회\n \n new_access_token = create_access_token(\n user_data,\n expires_delta=timedelta(minutes=15)\n )\n \n return jsonify({\n \"access_token\": new_access_token\n })\n\n@app.route(\"/api/logout\", methods=[\"POST\"])\ndef logout():\n \"\"\"로그아웃 (Refresh Token 무효화)\"\"\"\n data = request.get_json()\n refresh_token = data.get(\"refresh_token\")\n \n if refresh_token in token_store:\n del token_store[refresh_token]\n \n return jsonify({\"message\": \"Logged out successfully\"})from flask import Flask, request, jsonify, redirect\nimport jwt\nfrom datetime import datetime, timedelta\n\napp = Flask(__name__)\n\n# 클라이언트 정보 (실제로는 데이터베이스)\nclients = {\n \"client-id-123\": {\n \"client_secret\": \"client-secret-456\",\n \"redirect_uris\": [\"http://localhost:5000/callback\"],\n \"scopes\": [\"read\", \"write\"]\n }\n}\n\n# Authorization Code 저장소\nauth_codes = {}\n\n@app.route(\"/authorize\", methods=[\"GET\"])\ndef authorize():\n \"\"\"Authorization Code 발급\"\"\"\n client_id = request.args.get(\"client_id\")\n redirect_uri = request.args.get(\"redirect_uri\")\n response_type = request.args.get(\"response_type\")\n scope = request.args.get(\"scope\")\n state = request.args.get(\"state\")\n \n # 클라이언트 검증\n if client_id not in clients:\n return jsonify({\"error\": \"invalid_client\"}), 400\n \n if redirect_uri not in clients[client_id][\"redirect_uris\"]:\n return jsonify({\"error\": \"invalid_redirect_uri\"}), 400\n \n if response_type != \"code\":\n return jsonify({\"error\": \"unsupported_response_type\"}), 400\n \n # 사용자 인증 (실제로는 로그인 페이지)\n # 여기서는 간단히 사용자 ID를 받는다고 가정\n user_id = request.args.get(\"user_id\", \"123\")\n \n # Authorization Code 생성\n import secrets\n auth_code = secrets.token_urlsafe(32)\n auth_codes[auth_code] = {\n \"client_id\": client_id,\n \"user_id\": user_id,\n \"scope\": scope,\n \"created_at\": datetime.utcnow(),\n \"expires_in\": 600 # 10분\n }\n \n # 리다이렉트\n redirect_url = f\"{redirect_uri}?code={auth_code}&state={state}\"\n return redirect(redirect_url)\n\n@app.route(\"/token\", methods=[\"POST\"])\ndef token():\n \"\"\"Access Token 발급\"\"\"\n grant_type = request.form.get(\"grant_type\")\n \n if grant_type == \"authorization_code\":\n # Authorization Code Flow\n code = request.form.get(\"code\")\n client_id = request.form.get(\"client_id\")\n client_secret = request.form.get(\"client_secret\")\n redirect_uri = request.form.get(\"redirect_uri\")\n \n # Authorization Code 검증\n if code not in auth_codes:\n return jsonify({\"error\": \"invalid_grant\"}), 400\n \n auth_info = auth_codes[code]\n \n # 만료 확인\n if (datetime.utcnow() - auth_info[\"created_at\"]).seconds > auth_info[\"expires_in\"]:\n del auth_codes[code]\n return jsonify({\"error\": \"invalid_grant\"}), 400\n \n # 클라이언트 검증\n if client_id != auth_info[\"client_id\"]:\n return jsonify({\"error\": \"invalid_client\"}), 400\n \n if client_secret != clients[client_id][\"client_secret\"]:\n return jsonify({\"error\": \"invalid_client\"}), 400\n \n # JWT Access Token 생성\n user_data = {\n \"user_id\": auth_info[\"user_id\"],\n \"client_id\": client_id,\n \"scope\": auth_info[\"scope\"]\n }\n \n access_token = create_access_token(user_data, timedelta(hours=1))\n refresh_token = create_refresh_token({\"user_id\": auth_info[\"user_id\"]})\n \n # Authorization Code 삭제\n del auth_codes[code]\n \n return jsonify({\n \"access_token\": access_token,\n \"token_type\": \"Bearer\",\n \"expires_in\": 3600,\n \"refresh_token\": refresh_token,\n \"scope\": auth_info[\"scope\"]\n })\n \n elif grant_type == \"refresh_token\":\n # Refresh Token Flow\n refresh_token = request.form.get(\"refresh_token\")\n client_id = request.form.get(\"client_id\")\n client_secret = request.form.get(\"client_secret\")\n \n # Refresh Token 검증\n payload = verify_token(refresh_token)\n if not payload or payload.get(\"type\") != \"refresh\":\n return jsonify({\"error\": \"invalid_grant\"}), 400\n \n # 클라이언트 검증\n if client_secret != clients[client_id][\"client_secret\"]:\n return jsonify({\"error\": \"invalid_client\"}), 400\n \n # 새 Access Token 생성\n user_data = {\"user_id\": payload[\"user_id\"], \"client_id\": client_id}\n access_token = create_access_token(user_data, timedelta(hours=1))\n \n return jsonify({\n \"access_token\": access_token,\n \"token_type\": \"Bearer\",\n \"expires_in\": 3600\n })\n \n else:\n return jsonify({\"error\": \"unsupported_grant_type\"}), 400@app.route(\"/api/user/profile\")\n@token_required\ndef get_user_profile():\n \"\"\"사용자 프로필 조회\"\"\"\n user = request.current_user\n user_id = user[\"user_id\"]\n \n # 실제로는 데이터베이스에서 조회\n profile = {\n \"user_id\": user_id,\n \"username\": \"alice\",\n \"email\": \"alice@example.com\"\n }\n \n return jsonify(profile)\n\n@app.route(\"/api/data\", methods=[\"GET\", \"POST\"])\n@token_required\ndef handle_data():\n \"\"\"리소스 접근\"\"\"\n user = request.current_user\n \n # Scope 검증\n scopes = user.get(\"scope\", \"\").split()\n if \"read\" not in scopes and request.method == \"GET\":\n return jsonify({\"error\": \"insufficient_scope\"}), 403\n \n if \"write\" not in scopes and request.method == \"POST\":\n return jsonify({\"error\": \"insufficient_scope\"}), 403\n \n if request.method == \"GET\":\n return jsonify({\"data\": \"some data\"})\n else:\n return jsonify({\"message\": \"Data created\"}), 201# 1. HTTPS 사용 필수\n# 2. 토큰을 안전하게 저장 (HttpOnly Cookie)\nfrom flask import make_response\n\n@app.route(\"/login\", methods=[\"POST\"])\ndef login():\n # 로그인 처리\n user_data = {\"user_id\": 123, \"username\": \"alice\"}\n access_token = create_access_token(user_data)\n refresh_token = create_refresh_token({\"user_id\": user_data[\"user_id\"]})\n \n response = make_response(jsonify({\"message\": \"Login successful\"}))\n \n # HttpOnly Cookie로 저장 (XSS 방지)\n response.set_cookie(\n \"access_token\",\n access_token,\n httponly=True,\n secure=True, # HTTPS만\n samesite=\"Strict\", # CSRF 방지\n max_age=900 # 15분\n )\n \n response.set_cookie(\n \"refresh_token\",\n refresh_token,\n httponly=True,\n secure=True,\n samesite=\"Strict\",\n max_age=2592000 # 30일\n )\n \n return response\n\n# 3. 토큰 만료 시간 단축\naccess_token = create_access_token(user_data, timedelta(minutes=15))\n\n# 4. 토큰 블랙리스트 (로그아웃 시)\nblacklisted_tokens = set()\n\ndef is_token_blacklisted(token: str) -> bool:\n return token in blacklisted_tokens\n\ndef verify_token_secure(token: str):\n \"\"\"보안 강화된 토큰 검증\"\"\"\n # 블랙리스트 확인\n if is_token_blacklisted(token):\n return None\n \n # 토큰 검증\n payload = verify_token(token)\n if not payload:\n return None\n \n # 추가 검증 (IP 주소, User-Agent 등)\n # 실제로는 토큰에 포함된 정보와 요청 정보 비교\n \n return payloadimport secrets\n\n# CSRF 토큰 생성\ndef generate_csrf_token():\n return secrets.token_urlsafe(32)\n\n# CSRF 토큰 검증\ndef verify_csrf_token(token: str, session_token: str) -> bool:\n return token == session_token and len(token) > 0\n\n@app.route(\"/api/sensitive-action\", methods=[\"POST\"])\n@token_required\ndef sensitive_action():\n \"\"\"CSRF 보호가 필요한 액션\"\"\"\n csrf_token = request.headers.get(\"X-CSRF-Token\")\n session_token = session.get(\"csrf_token\")\n \n if not verify_csrf_token(csrf_token, session_token):\n return jsonify({\"error\": \"Invalid CSRF token\"}), 403\n \n # 액션 수행\n return jsonify({\"message\": \"Action completed\"})from functools import wraps\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\n\n# Rate Limiting 저장소\nrate_limit_store = defaultdict(list)\n\ndef rate_limit(max_requests: int = 5, window: int = 60):\n \"\"\"Rate Limiting 데코레이터\"\"\"\n def decorator(f):\n @wraps(f)\n def decorated_function(*args, **kwargs):\n # 클라이언트 식별 (IP 주소 또는 사용자 ID)\n client_id = request.remote_addr\n \n now = datetime.utcnow()\n window_start = now - timedelta(seconds=window)\n \n # 윈도우 내 요청 수 확인\n requests_in_window = [\n req_time for req_time in rate_limit_store[client_id]\n if req_time > window_start\n ]\n \n if len(requests_in_window) >= max_requests:\n return jsonify({\n \"error\": \"Rate limit exceeded\",\n \"retry_after\": window\n }), 429\n \n # 요청 시간 기록\n rate_limit_store[client_id].append(now)\n \n return f(*args, **kwargs)\n return decorated_function\n return decorator\n\n@app.route(\"/api/login\", methods=[\"POST\"])\n@rate_limit(max_requests=5, window=60)\ndef login():\n # 로그인 처리\n passfrom flask import Flask, request, jsonify, session\nfrom functools import wraps\nimport jwt\nfrom datetime import datetime, timedelta\n\napp = Flask(__name__)\napp.secret_key = \"your-secret-key\"\n\n# 사용자 데이터베이스 (실제로는 DB 사용)\nusers = {\n \"alice\": {\"password\": \"hashed_password\", \"user_id\": 1, \"roles\": [\"user\"]},\n \"bob\": {\"password\": \"hashed_password\", \"user_id\": 2, \"roles\": [\"user\", \"admin\"]}\n}\n\ndef create_token(user_data: dict):\n \"\"\"JWT 토큰 생성\"\"\"\n payload = {\n \"user_id\": user_data[\"user_id\"],\n \"username\": user_data[\"username\"],\n \"roles\": user_data[\"roles\"],\n \"exp\": datetime.utcnow() + timedelta(hours=1),\n \"iat\": datetime.utcnow()\n }\n return jwt.encode(payload, app.secret_key, algorithm=\"HS256\")\n\ndef verify_token(token: str):\n \"\"\"JWT 토큰 검증\"\"\"\n try:\n payload = jwt.decode(token, app.secret_key, algorithms=[\"HS256\"])\n return payload\n except jwt.InvalidTokenError:\n return None\n\ndef token_required(f):\n @wraps(f)\n def decorated(*args, **kwargs):\n token = None\n if \"Authorization\" in request.headers:\n token = request.headers[\"Authorization\"].split(\" \")[1]\n \n if not token:\n return jsonify({\"error\": \"Token is missing\"}), 401\n \n payload = verify_token(token)\n if not payload:\n return jsonify({\"error\": \"Token is invalid\"}), 401\n \n request.current_user = payload\n return f(*args, **kwargs)\n return decorated\n\ndef role_required(*roles):\n \"\"\"역할 기반 접근 제어\"\"\"\n def decorator(f):\n @wraps(f)\n @token_required\n def decorated(*args, **kwargs):\n user_roles = request.current_user.get(\"roles\", [])\n if not any(role in user_roles for role in roles):\n return jsonify({\"error\": \"Insufficient permissions\"}), 403\n return f(*args, **kwargs)\n return decorated\n return decorator\n\n@app.route(\"/api/login\", methods=[\"POST\"])\ndef login():\n data = request.get_json()\n username = data.get(\"username\")\n password = data.get(\"password\")\n \n # 사용자 인증 (실제로는 해시된 비밀번호 검증)\n if username not in users:\n return jsonify({\"error\": \"Invalid credentials\"}), 401\n \n user = users[username]\n # 실제로는 bcrypt 등으로 비밀번호 검증\n if password != user[\"password\"]:\n return jsonify({\"error\": \"Invalid credentials\"}), 401\n \n # 토큰 생성\n token = create_token({\n \"user_id\": user[\"user_id\"],\n \"username\": username,\n \"roles\": user[\"roles\"]\n })\n \n return jsonify({\"access_token\": token})\n\n@app.route(\"/api/profile\")\n@token_required\ndef get_profile():\n user = request.current_user\n return jsonify({\n \"user_id\": user[\"user_id\"],\n \"username\": user[\"username\"],\n \"roles\": user[\"roles\"]\n })\n\n@app.route(\"/api/admin\")\n@role_required(\"admin\")\ndef admin_only():\n return jsonify({\"message\": \"Admin access granted\"})OAuth 2.0과 JWT는 현대적인 인증/인가 시스템의 핵심이다. 이 글에서 다룬 내용:
\n이러한 기술들을 적절히 조합하면 안전하고 확장 가능한 인증/인가 시스템을 구축할 수 있다.
\nOAuth 2.0과 JWT 완전정복 - 인증/인가 실전 가이드
\n