Timeline for Could the Authorization Server return the code directly to the client instead of using a redirect in OAuth2 Autorization code flow?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2019 at 12:27 | comment | added | tom johnes | This is so true. The three parties receive the token. I was wondering how to give another adress to the user-agent since I don't want the auth code to be known by it. | |
| Nov 18, 2019 at 19:24 | history | edited | AGrzes | CC BY-SA 4.0 |
Reworded and clarified explanation
|
| Nov 18, 2019 at 18:11 | comment | added | AGrzes | From the end - the resource owner (usually) is the person that is the person that authorizes (or not) the access. The client is an application that want to get access. In redirect user agent receives some URL and opens it. The information contained in URL is know to all three parties (server sending redirect, user agent, target server) and it is trivial to modify user agent to capture the URL instead of sending it to the target server. I will try to clarify my answer but it may take some time. | |
| Nov 18, 2019 at 15:34 | comment | added | tom johnes | I will read your answer again. I did not undertand everything. But you are saying in both case the Auth Server will give the code directly to the Client ? What would be the use of the redirect then ? What does the user-agent do when it's redirected anyway ? I'll still confused here. Resource owner receives the code or is it the client... I'm confused lol | |
| Nov 18, 2019 at 14:29 | history | answered | AGrzes | CC BY-SA 4.0 |