Timeline for Why do OAuth2 PKCE authorization codes have client_id?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 28 at 23:31 | vote | accept | Cort Ammon | ||
| Apr 28 at 18:39 | comment | added | Steve P | Right, the main protection in that case is the authorization server enforcing that the authorization code is only sent to the pre-configured list of redirect URLs. | |
| Apr 27 at 22:00 | comment | added | Cort Ammon | Ahh, those make sense. So does this mean that if someone makes a public client and that client requests some resources, a 3rd party could make the exact same request and get their own access token if they could convince the Resource Owner to give them an authentication code of their own? | |
| Apr 27 at 21:47 | history | answered | Steve P | CC BY-SA 4.0 |