AGrzes's user avatar
AGrzes's user avatar
AGrzes's user avatar
AGrzes
  • Member for 8 years, 7 months
  • Last seen this week
10 votes

IN OAuth 2.0, how is the client secret supposed to be kept secret?

4 votes
Accepted

Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?

3 votes
Accepted

Is it necessary to protect the Oauth2 return URL

2 votes

Securing API access. oAuth Client Credentials vs client ID and secret

2 votes
Accepted

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

1 vote

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

1 vote

Why is there a redirect to the native app in PKCE?

1 vote

OAuth 2.0, what should it be returned in the authorize endpoint if the client_id is wrong and no redirect_uri is passed

1 vote

Can we store sensitive client information with the admins without them(admins) identifying it?

1 vote
Accepted

Can oauth2 "state" parameter be used to avoid using session cookies to identify user

0 votes
Accepted

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

0 votes

Could the Authorization Server return the code directly to the client instead of using a redirect in OAuth2 Autorization code flow?