user avatar
user avatar
user avatar
AGrzes
  • Member for 7 years, 1 month
  • Last seen this week
4 votes

IN OAuth 2.0, how is the client secret supposed to be kept secret?

4 votes
Accepted

Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?

3 votes
Accepted

Is it necessary to protect the Oauth2 return URL

1 vote

Securing API access. oAuth Client Credentials vs client ID and secret

1 vote

Can we store sensitive client information with the admins without them(admins) identifying it?

1 vote
Accepted

Can oauth2 "state" parameter be used to avoid using session cookies to identify user

1 vote
Accepted

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

1 vote

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

1 vote

Why is there a redirect to the native app in PKCE?

1 vote

OAuth 2.0, what should it be returned in the authorize endpoint if the client_id is wrong and no redirect_uri is passed

0 votes
Accepted

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

0 votes

Could Redirection URI be a Client URI in OAuth2 Autorization code flow?