4 ms·
Token binding would solve this by binding OAuth tokens to TLS connections, so they can't be used even if stolen: https://tools.ietf.org/html/draft-jones-oauth-t
by rolodato 10y ago
Token binding would solve this by binding OAuth tokens to TLS connections, so they can't be used even if stolen: https://tools.ietf.org/html/draft-jones-oauth-token-binding-00 https://tools.ietf.org/html/draft-jones-oauth-token-binding-...
- notJim 10y agoWould this mean that the token is only good for the duration of the connection though? Most apps on mobile hold tokens that ~never expire (iirc I've never had to re-auth the Gmail app.)