oauth-v2-1

oauth-v2-1 copied to clipboard

2.1 added a lot of text around how clients form authorization requests, the language does not however account for the optional POST binding at the authorization endpoint. > The authorization...

panva

Reasons for recommending loopback redirects over private-use URI scheme

2

The current OAuth 2.1 draft mentions that > Many environments that support private-use URI schemes do not provide a mechanism to claim a scheme and prevent other parties from using...

archer-321

There has been a case where the signing key for the stateless JWT based access token was stolen and used by attacker to mint new access tokens. Since the token...

sakimura

Paragraph 1: it is not only the resource owners' password that can be phished. OTP etc. can be phished as well. Proposes to change: "steal resource owners' passwords" to "steal...

sakimura

Standardize refresh token expiration field in token responses

1

Hi, Is there a reason why the `expires_in` field exists but an equivalent for refresh token doesn't? Something like `refresh_token_expires_in`. I couldn't find any discussion on it in past mailing...

pilcrowonpaper