3 ms·
Can't they just also require that their implementation of OAuth2 also requires a signed payload?
by philliphaydon 8y ago
Can't they just also require that their implementation of OAuth2 also requires a signed payload?
- badrabbit 8y agoThen it would no longer be oauth2? Standards exist to prevent deviations. How do you manage signing keys and distribute them? What signature scheme,encoding,etc... Should be used?
- stedaniels 8y agoPlaying devils advocate. Show me a half decent commercial API that doesn't specify any rules of engagement with their API. All the minutiae would be specified there.
- dwaite 8y agoWhat they are doing is no longer OAuth 1, since they require a hash of the body as a parameter for input into the OAuth 1 signature/MAC.
- jsiepkes 8y agoSure. For example they could require you to sign the body of the HTTP request and put the signature in the HTTP "Authorization" header.
- user5994461 8y agoThe Authorization header is where the authentication token goes. It's already used.
- nmadden 8y agoThere is a (now expired) draft for sending signed HTTP requests using JWS that includes the access token as part of the signature data getting around this problem. Edit: forgot the link https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03 https://tools.ietf.org/html/draft-ietf-oauth-signed-http-req...