Timeline for What's the concrete case for code flow being more secure than implicit flow?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 7:24 | history | edited | CommunityBot |
replaced https://tools.ietf.org/html/draft with https://datatracker.ietf.org/doc/html/draft
|
|
| Jul 29, 2019 at 3:33 | comment | added | user3397781 | Thanks for the link! But in a case where the client backend finally gives the code flow's access token in the URL fragment to the client front end, it's as insecure as implicit flow, right? I mean, why does it matter in the end whether the one returning the access token is the auth server or the client backend? So to achieve that infamous code-flow security, we'd have to make it so that the front end doesn't see the token, eg. by proxying all resource request via the client backend, and having the access token in a secure HttpOnly cookie. | |
| Jul 23, 2019 at 12:04 | history | answered | Tangui | CC BY-SA 4.0 |