Cuộc gọi đáng tin cậy mối quan hệ các ứng dụng và cho phép cùng cho Flickr. Tuy nhiên, cuộc gọi không có đề cập rõ ràng của một người sử dụng ở tất cả. Không có tham số cho user_id, ví dụ. ContactLister Đó không phải vượt qua Flickr bất cứ điều gì về tài khoản Flickr của Lois là một đức tính không phải là một vấn đề. | 160 CHAPTER 6 LEARNING WEB SERVICES APIS THROUGH FLICKR The call reliably ties the app and permission together for Flickr. However the call has no explicit mention of a user at all. There s no parameter for user_id for instance. That ContactLister doesn t have to pass to Flickr anything about Lois s Flickr account is a virtue not a problem. Why should a third-party app have to know anything a priori about a person s relationship to Flickr So how does Flickr figure out the user to tie to the request by ContactLister for the read permission The fact is that it s Lois and not someone else who uses the authorization URL http services auth api_key api_key perms read api_sig f9258a76e4ad3cb5fa40bd8b0098d119 When Lois loads the authorization URL in her browser Flickr then determines the user in question. If Lois is logged in then Flickr knows the user in question is Lois. If no one is logged in to Flickr then Lois will be sent through the login process. In either case it s Flickr that is figuring out Lois s identity as a Flickr user and taking care of her authenticating to Flickr. In that way Flickr can establish to its own satisfaction the identity of the user involved in the authorization dance rather than trusting ContactLister to do so. Now that Flickr knows for sure the identity of the app the permission level requested and the user involved it still needs to actually ask Lois whether it s OK to let ContactLister have the requested read permission. If Lois had not already granted ContactLister such permission then Flickr presents to Lois a screen that clearly informs her of ContactLister s request. The fact that such a display comes from Flickr instead of ContactLister directly should give Lois some confidence that Flickr can track what ContactLister will do with any permissions she grants to it and thereby hold the authors of ContactLister accountable. Step 3 Flickr Lets ContactLister Know to Pick Up a Token Assuming that Lois grants ContactLister read .
