In the introduction part of OAuth 2.0 RFC document, the 4th bullet mentions as follows:

Resource owners cannot revoke access to an individual third party without revoking access to all third parties, and must do so by changing the third party's password.

Cloud someone clarify, what is meant by third party's password, in the end? I thought it order to revoke access, the resource owner needs to change the password in the server, so that all the 3rd party access would get revoked. Am I missing something?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.