New answers tagged oauth2
0
votes
In the Oauth2 client credentials grant, why do we use tokens instead of authorizing directly at each api call?
The point of OAuth is that a resource server delegates the task of client authentication and authorization to a dedicated server instead of doing this itself. If you don't want delegation, that's fine....
- 23.1k
0
votes
OAuth2 authorization code grant: in the case of a public client, what is the point of exchanging the authorization code for a token?
Preventing authorisation code leakage
If the authorization code is intercepted during transmission (e.g. via a malicious app or a network attack), the attacker would still need to execute the ...
- 3,035
1
vote
OAuth2 authorization code grant: in the case of a public client, what is the point of exchanging the authorization code for a token?
The authorization code is handed over to the client in the front-channel and thus known by the user and everyone knowing the URI with the code (browser addons, server logs).
Exchanging the code for an ...
- 161
7
votes
Accepted
OAuth2 authorization code grant: how does redirection work for mobile applications?
One version of this explanation can be seen here: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uris-native-apps/
Mobile (and desktop) applications can - and many do - register a URI ...
- 52.1k
4
votes
Accepted
Oauth2 client credentials grant: does authorization server always have to return an opaque access token?
The OAuth 2.0 standard doesn't mandate any particular access token type for the Client Credentials Grant – or any other grant. It's perfectly valid to respond with a signed JWT as a bearer token.
- 23.1k
2
votes
Integrating Biometrics with Auth Code Flow (w/ PKCE) on mobile
It is best practice for native mobile apps to use oAuth2 auth code flow with PKCE and avoid ROPC/implicit flow.
The current best practice is that you should use the authorization code flow with PKCE.
...
- 2,510
2
votes
Integrating Biometrics with Auth Code Flow (w/ PKCE) on mobile
It is best practice for native mobile apps to use oAuth2 auth code flow with PKCE
I assume you're talking about OIDC (which is built on OAuth2) as we're talking about authentication, but yes the auth ...
- 1,305
1
vote
Accepted
Bearer token in header as Basic token? - Does that violate the RFC6749 spec?
According to your comments, you want to obtain an access token through the Resource Owner Password Credentials Grant and then use this token as a client credential to obtain new access tokens through ...
- 23.1k
Top 50 recent answers are included