關於 javascript window opener location close ，我們在網路上蒐集到這些相關的討論、資訊與評價

Generate a URL to request access from Google's OAuth 2.0 endpoint at
https://accounts.google.com/o/oauth2/v2/auth. This endpoint is accessible over HTTPS;
plain HTTP connections are refused.

The Google authorization server supports the following query string parameters for web
server applications:

The client ID for your application. You can find this value in the
Cloud Console
Clients page.

Determines where the API server redirects the user after the user completes the
authorization flow. The value must exactly match one of the authorized redirect URIs for
the OAuth 2.0 client, which you configured in your client's
Cloud Console
Clients page. If this value doesn't match an
authorized redirect URI for the provided client_id you will get a
redirect_uri_mismatch error.

Note that the http or https scheme, case, and trailing slash
('/') must all match.

JavaScript applications need to set the parameter's value to token. This
value instructs the Google Authorization Server to return the access token as a
name=value pair in the fragment identifier of the URI (#) to which
the user is redirected after completing the authorization process.

A
space-delimited
list of scopes that identify the resources that your application could access on the
user's behalf. These values inform the consent screen that Google displays to the
user.

Scopes enable your application to only request access to the resources that it needs
while also enabling users to control the amount of access that they grant to your
application. Thus, there is an inverse relationship between the number of scopes requested
and the likelihood of obtaining user consent.

The YouTube Data API v3 uses the following scopes:

The OAuth 2.0 API Scopes document provides
a full list of scopes that you might use to access Google APIs.

We recommend that your application request access to authorization scopes in context
whenever possible. By requesting access to user data in context, via
incremental authorization, you help users to more easily
understand why your application needs the access it is requesting.

Specifies any string value that your application uses to maintain state between your
authorization request and the authorization server's response.
The server returns the exact value that you send as a name=value pair in the
URL fragment identifier (#)
of the
redirect_uri after the user consents to or denies your application's
access request.

You can use this parameter for several purposes, such as directing the user to the
correct resource in your application, sending nonces, and mitigating cross-site request
forgery. Since your redirect_uri can be guessed, using a state
value can increase your assurance that an incoming connection is the result of an
authentication request. If you generate a random string or encode the hash of a cookie or
another value that captures the client's state, you can validate the response to
additionally ensure that the request and response originated in the same browser,
providing protection against attacks such as
cross-site request
forgery. See the
OpenID Connect
documentation for an example of how to create and confirm a state token.

Enables applications to use incremental authorization to request access to additional
scopes in context. If you set this parameter's value to true and the
authorization request is granted, then the new access token will also cover any scopes to
which the user previously granted the application access. See the
incremental authorization section for examples.

Defaults to true. If set to false,
more
granular Google Account permissions
will be disabled for OAuth client IDs created before 2019. No effect for newer
OAuth client IDs, since more granular permissions is always enabled for them.

When Google enables granular permissions for an application, this parameter will no
longer have any effect.

If your application knows which user is trying to authenticate, it can use this parameter
to provide a hint to the Google Authentication Server. The server uses the hint to
simplify the login flow either by prefilling the email field in the sign-in form or by
selecting the appropriate multi-login session.

Set the parameter value to an email address or sub identifier, which is
equivalent to the user's Google ID.

A space-delimited, case-sensitive list of prompts to present the user. If you don't
specify this parameter, the user will be prompted only the first time your project
requests access. See
Prompting re-consent for more information.

Possible values are:

The sample URL below requests offline access
(access_type=offline) to a scope that permits access to view
the user's YouTube account. It uses incremental authorization to ensure that
the new access token covers any scopes to which the user previously granted
the application access. The URL also sets values for the required
redirect_uri, response_type, and
client_id parameters as well as for the state
parameter. The URL contains line breaks and spaces for readability.

 https://accounts.google.com/o/oauth2/v2/auth?
  scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.readonly&
  include_granted_scopes=true&
  state=state_parameter_passthrough_value&
  redirect_uri=http%3A%2F%2Flocalhost%2Foauth2callback&
  response_type=token&
  client_id=client_id

After you create the request URL, redirect the user to it.

The following JavaScript snippet shows how to initiate the authorization flow in
JavaScript without using the Google APIs Client Library for JavaScript. Since this OAuth
2.0 endpoint does not support Cross-Origin Resource Sharing (CORS), the snippet creates a
form that opens the request to that endpoint.

/*
  * Create form to request access token from Google's OAuth 2.0 server.
  */
 function oauthSignIn() {
   // Google's OAuth 2.0 endpoint for requesting an access token
   var oauth2Endpoint = 'https://accounts.google.com/o/oauth2/v2/auth';  // Create <form> element to submit parameters to OAuth 2.0 endpoint.
   var form = document.createElement('form');
   form.setAttribute('method', 'GET'); // Send as a GET request.
   form.setAttribute('action', oauth2Endpoint);  // Parameters to pass to OAuth 2.0 endpoint.
   var params = {'client_id': 'YOUR_CLIENT_ID',
                 'redirect_uri': 'YOUR_REDIRECT_URI',
                 'response_type': 'token',
                 'scope': 'https://www.googleapis.com/auth/youtube.force-ssl',
                 'include_granted_scopes': 'true',
                 'state': 'pass-through value'};  // Add form parameters as hidden input values.
   for (var p in params) {
     var input = document.createElement('input');
     input.setAttribute('type', 'hidden');
     input.setAttribute('name', p);
     input.setAttribute('value', params[p]);
     form.appendChild(input);
   }  // Add form to page and submit it to open the OAuth 2.0 endpoint.
   document.body.appendChild(form);
   form.submit();
 }

The OAuth 2.0 server sends a response to the redirect_uri specified in your
access token request.

If the user approves the request, then the response contains an access token. If the user
does not approve the request, the response contains an error message. The access token or
error message is returned on the hash fragment of the redirect URI, as shown below:

An access token response:

 https://oauth2.example.com/callback#access_token=4/P7q7W91&token_type=Bearer&expires_in=3600

In addition to the access_token parameter, the fragment string also
contains the token_type parameter, which is always set to
Bearer, and the expires_in parameter, which specifies the
lifetime of the token, in seconds. If the state parameter was specified
in the access token request, its value is also included in the response.

 https://oauth2.example.com/callback#error=access_denied

You can test this flow by clicking on the following sample URL, which requests
read-only access to view metadata for files in your Google Drive and read-only
access to view your Google Calendar events:

 https://accounts.google.com/o/oauth2/v2/auth?
  scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.readonly&
  include_granted_scopes=true&
  state=state_parameter_passthrough_value&
  redirect_uri=http%3A%2F%2Flocalhost%2Foauth2callback&
  response_type=token&
  client_id=client_id

After completing the OAuth 2.0 flow, you will be redirected to
http://localhost/oauth2callback. That URL will yield a
404 NOT FOUND error unless your local machine happens to serve a file at
that address. The next step provides more detail about the information returned in the
URI when the user is redirected back to your application.

To check whether the user has granted your application access to a particular scope,
exam the scope field in the access token response. The scopes of access granted by
the access_token expressed as a list of space-delimited, case-sensitive strings.

For example, the following sample access token response indicates that the user has granted your
application permission to see, edit, and permanently delete user's YouTube videos, ratings,
comments and captions:

  {
     "access_token": "1/fFAGRNJru1FTz70BzhT3Zg",
     "expires_in": 3920,
     "token_type": "Bearer",
     "scope": "https://www.googleapis.com/auth/youtube.force-ssl",
     "refresh_token": "1//xEoDL4iW3cxlI7yDbSRFYNG01kVKM2C-259HOF2aQbI"
   }

After your application obtains an access token, you can use the token to make calls to a Google
API on behalf of a given
user account if the scope(s) of access required by the API have been granted. To do this, include
the access token in a request to the API by including either an access_token query
parameter or an Authorization HTTP header Bearer value. When possible,
the HTTP header is preferable, because query strings tend to be visible in server logs. In most
cases you can use a client library to set up your calls to Google APIs (for example, when
calling the YouTube Data API).

Note that the YouTube Data API supports service accounts only for YouTube
content owners that own and manage multiple YouTube channels, such as record
labels and movie studios.

You can try out all the Google APIs and view their scopes at the
OAuth 2.0 Playground.

A call to the

youtube.channels
endpoint (the YouTube Data API) using the Authorization: Bearer HTTP
header might look like the following. Note that you need to specify your own access token:

 GET /youtube/v3/channels?part=snippet&mine=true HTTP/1.1
 Host: www.googleapis.com
 Authorization: Bearer access_token

Here is a call to the same API for the authenticated user using the access_token
query string parameter:

 GET https://www.googleapis.com/youtube/v3/channels?access_token=access_token&part=snippet&mine=true

You can test these commands with the curl command-line application. Here's an
example that uses the HTTP header option (preferred):

 curl -H "Authorization: Bearer access_token" https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true

Or, alternatively, the query string parameter option:

 curl https://www.googleapis.com/youtube/v3/channels?access_token=access_token&part=snippet&mine=true

The code snippet below demonstrates how to use CORS (Cross-origin resource sharing) to send a
request to a Google API. This example does not use the Google APIs Client Library for JavaScript.
However, even if you are not using the client library, the
CORS support guide in that library's documentation will likely help you
to better understand these requests.

In this code snippet, the access_token variable represents the token you have
obtained to make API requests on the authorized user's behalf. The complete
example demonstrates how to store that token in the browser's local storage and retrieve it
when making an API request.

var xhr = new XMLHttpRequest();
 xhr.open('GET',
     'https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true&' +
     'access_token=' + params['access_token']);
 xhr.onreadystatechange = function (e) {
   console.log(xhr.response);
 };
 xhr.send(null);

This code sample demonstrates how to complete the OAuth 2.0 flow in JavaScript without using the
Google APIs Client Library for JavaScript. The code is for an HTML page that displays a button to
try an API request. If you click the button, the code checks to see whether the page has stored an
API access token in your browser's local storage. If so, it executes the API request. Otherwise,
it initiates the OAuth 2.0 flow.

For the OAuth 2.0 flow, the page follows these steps:

If the user has granted access to the requested scope()s, the page uses the access
token to make the sample API request.

This API request calls the YouTube Data API's channels.list method
to retrieve data about the authorized user's YouTube channel.

You can revoke access to the app through the
Permissions page for your
Google Account. The app will be listed as OAuth 2.0 Demo for Google API Docs.

To run this code locally, you need to set values for the YOUR_CLIENT_ID and
YOUR_REDIRECT_URI variables that correspond to your
authorization credentials. The YOUR_REDIRECT_URI variable
should be set to the same URL where the page is being served. The value must exactly match one of
the authorized redirect URIs for the OAuth 2.0 client, which you configured in the
Cloud Console
Clients page. If
this value doesn't match an authorized URI, you will get a redirect_uri_mismatch
error. Your project must also have
enabled the appropriate API for this request.

<html><head></head><body>
 <script>
   var YOUR_CLIENT_ID = 'REPLACE_THIS_VALUE';
   var YOUR_REDIRECT_URI = 'REPLACE_THIS_VALUE';  // Parse query string to see if page request is coming from OAuth 2.0 server.
   var fragmentString = location.hash.substring(1);
   var params = {};
   var regex = /([^&=]+)=([^&]*)/g, m;
   while (m = regex.exec(fragmentString)) {
     params[decodeURIComponent(m[1])] = decodeURIComponent(m[2]);
   }
   if (Object.keys(params).length > 0 && params['state']) {
     if (params['state'] == localStorage.getItem('state')) {
       localStorage.setItem('oauth2-test-params', JSON.stringify(params) );      trySampleRequest();
     } else {
       console.log('State mismatch. Possible CSRF attack');
     }
   }  // Function to generate a random state value
   function generateCryptoRandomState() {
     const randomValues = new Uint32Array(2);
     window.crypto.getRandomValues(randomValues);    // Encode as UTF-8
     const utf8Encoder = new TextEncoder();
     const utf8Array = utf8Encoder.encode(
       String.fromCharCode.apply(null, randomValues)
     );    // Base64 encode the UTF-8 data
     return btoa(String.fromCharCode.apply(null, utf8Array))
       .replace(/\+/g, '-')
       .replace(/\//g, '_')
       .replace(/=+$/, '');
   }  // If there's an access token, try an API request.
   // Otherwise, start OAuth 2.0 flow.
   function trySampleRequest() {
     var params = JSON.parse(localStorage.getItem('oauth2-test-params'));
     if (params && params['access_token']) { 
       var xhr = new XMLHttpRequest();
       xhr.open('GET',
           'https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true&' +
           'access_token=' + params['access_token']);
       xhr.onreadystatechange = function (e) {
         if (xhr.readyState === 4 && xhr.status === 200) {
           console.log(xhr.response);
         } else if (xhr.readyState === 4 && xhr.status === 401) {
           // Token invalid, so prompt for user permission.
           oauth2SignIn();
         }
       };
       xhr.send(null); 
     } else {
       oauth2SignIn();
     }
   }  /*
    * Create form to request access token from Google's OAuth 2.0 server.
    */
   function oauth2SignIn() {
     // create random state value and store in local storage
     var state = generateCryptoRandomState();
     localStorage.setItem('state', state);    // Google's OAuth 2.0 endpoint for requesting an access token
     var oauth2Endpoint = 'https://accounts.google.com/o/oauth2/v2/auth';    // Create element to open OAuth 2.0 endpoint in new window.
     var form = document.createElement('form');
     form.setAttribute('method', 'GET'); // Send as a GET request.
     form.setAttribute('action', oauth2Endpoint);    // Parameters to pass to OAuth 2.0 endpoint.
     var params = {'client_id': YOUR_CLIENT_ID,
                   'redirect_uri': YOUR_REDIRECT_URI,
                   'scope': 'https://www.googleapis.com/auth/youtube.force-ssl',
                   'state': state,
                   'include_granted_scopes': 'true',
                   'response_type': 'token'};    // Add form parameters as hidden input values.
     for (var p in params) {
       var input = document.createElement('input');
       input.setAttribute('type', 'hidden');
       input.setAttribute('name', p);
       input.setAttribute('value', params[p]);
       form.appendChild(input);
     }    // Add form to page and submit it to open the OAuth 2.0 endpoint.
     document.body.appendChild(form);
     form.submit();
   }
 </script><button onclick="trySampleRequest();">Try sample request</button>
 </body></html>

In this example, the calling application requests access to retrieve the
user's YouTube Analytics data in addition to any other access that the user
has already granted to the application.

To add scopes to an existing access token, include the include_granted_scopes
parameter in your request to Google's OAuth 2.0 server.

The following code snippet demonstrates how to do that. The snippet assumes that you have stored
the scopes for which your access token is valid in the browser's local storage. (The
complete example code stores a list of scopes for which the access token
is valid by setting the oauth2-test-params.scope property in the browser's local
storage.)

The snippet compares the scopes for which the access token is valid to the scope you want to use
for a particular query. If the access token does not cover that scope, the OAuth 2.0 flow starts.
Here, the oauth2SignIn function is the same as the one that was provided in
step 2 (and that is provided later in the complete
example).

var SCOPE = 'https://www.googleapis.com/auth/youtube.force-ssl';
 var params = JSON.parse(localStorage.getItem('oauth2-test-params'));var current_scope_granted = false;
 if (params.hasOwnProperty('scope')) {
   var scopes = params['scope'].split(' ');
   for (var s = 0; s < scopes.length; s++) {
     if (SCOPE == scopes[s]) {
       current_scope_granted = true;
     }
   }
 }if (!current_scope_granted) {
   oauth2SignIn(); // This function is defined elsewhere in this document.
 } else {
   // Since you already have access, you can proceed with the API request.
 }

To programmatically revoke a token, your application makes a request to
https://oauth2.googleapis.com/revoke and includes the token as a parameter:

 curl -d -X -POST --header "Content-type:application/x-www-form-urlencoded" \
         https://oauth2.googleapis.com/revoke?token={token}

The token can be an access token or a refresh token. If the token is an access token and it has a
corresponding refresh token, the refresh token will also be revoked.

If the revocation is successfully processed, then the HTTP status code of the response is
200. For error conditions, an HTTP status code 400 is returned along
with an error code.

The following JavaScript snippet shows how to revoke a token in JavaScript without using the
Google APIs Client Library for JavaScript. Since the Google's OAuth 2.0 endpoint for revoking
tokens does not support Cross-origin Resource Sharing (CORS), the code creates a form and submits
the form to the endpoint rather than using the XMLHttpRequest() method to post the
request.

function revokeAccess(accessToken) {
   // Google's OAuth 2.0 endpoint for revoking access tokens.
   var revokeTokenEndpoint = 'https://oauth2.googleapis.com/revoke';  // Create <form> element to use to POST data to the OAuth 2.0 endpoint.
   var form = document.createElement('form');
   form.setAttribute('method', 'post');
   form.setAttribute('action', revokeTokenEndpoint);  // Add access token to the form so it is set as value of 'token' parameter.
   // This corresponds to the sample curl request, where the URL is:
   //      https://oauth2.googleapis.com/revoke?token={token}
   var tokenField = document.createElement('input');
   tokenField.setAttribute('type', 'hidden');
   tokenField.setAttribute('name', 'token');
   tokenField.setAttribute('value', accessToken);
   form.appendChild(tokenField);  // Add form to page and submit it to actually revoke the token.
   document.body.appendChild(form);
   form.submit();
 }