I'm trying to understand if the vulnerability described in the specification for implicit flow : link is the same principle of a man in the middle attack. From what I understood, the malicious client get in the way of the access token grant and then impersonate an issuer. Yes he isn't really "in the middle" like the aforementioned but there's still an impersonation in place.

I'm asking here because there might be some concepts I didn't grasp and I want to gain a full understanding of what I'm trying to implement.

Thank you in advance for enlightening me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.