I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it?
Any side effects of using this implementation?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community