I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to visit a client's server. Just to be clear, I'm not proposing any sort of extension to OAuth 2, this is simply a flow that makes more sense for me and my particular application.
The flow I'd like to enable would be:
- A user is shown a list of clients to grant access to on my server
- Once a user indicates they'd like to grant access to a client, I generate an access grant and then send a POST request to an endpoint on the client's server with the authorization code that I generated.
- The client would then exchange that authorization code for an access token in exactly the same way as they would if the user had been redirected to their redirect_uri as part of the authorization code flow.
So the only differences are that the client doesn't redirect any users to my server as they normally would to request access, I allow authenticated users to authorize clients on my own server without them ever needing to visit a client's site, and rather than handling a GET request from my server with the authorization code in a query param and then exchanging it for an access token, clients will instead handle a POST request from my server with the code in the request body. I will continue to support the authorization code flow, but in cases where it makes sense, would also like to support this alternative one.
Anyone see any reason this flow might be insecure? It's simply my server sending a POST to a client's registered endpoint on their server, and then them sending one back as they would anyway, both over SSL.