Protocol Flow Diagram

[jricher]

The protocol flow diagram in 1.2 is confusing to readers, and it's not uncommon for a reader to think "Resource Owner" is another computer alongside the Authorization Server and Resource Server. This is further confounded by the text:

The authorization request can be made directly to the resource owner (as shown),

With the removal of the password grant, this should be updated both in the diagram and the text to show that the authorization grant is mediated through the AS. Even better, I would argue that this protocol flow is too abstract to be useful in most explanations, and the diagram does more harm than good.

[aaronpk]

You did point this out in 2021 :joy: https://github.com/oauth-wg/oauth-v2-1/issues/26#issuecomment-771281328