Tag Info

New answers tagged

1

There are a number of different grant types supported by OAuth 2.0, and they enable the client application to interact with a resource server on behalf of the resource owner in different ways. There are security implications to using an implicit grant, which is the type that does not require a client secret. Specifically, in this authorization flow, the ...


0

I haven't read the spec so I'm making assumptions here but it could allow you to support basic clients and differentiate depending on whether the client sends you a client_secret or not. For example, you could enforce a more stringent expiry rule on the request_token you send back to the client if they don't send you a client_secret. Private secrets like ...


0

Separating the autzcode and the token allows de-coupling authentication and session handling. Advantages include the possibility of using multiple authentication services without adapting the session handling code and detecting misuse by malicious or compromised providers after legitimate user authentication. For details see ...


0

I think that what he is trying to say is that you should not keep all the keys in the same place. The compartmentalization of the process is what plays the key role in the auth mechanism he suggests. One thing that you should also keep note is to take benefit from the Same Origin Policy. Using SOP will prevent attackers from manipulating data from a domain ...



Top 50 recent answers are included