4 ms·

I've only ever implemented web-based OAuth flows, so I haven't seen that behavior. Do they also disallow the use of refresh tokens? It would seem that allowing

I've only ever implemented web-based OAuth flows, so I haven't seen that behavior. Do they also disallow the use of refresh tokens? It would seem that allowing refresh would let a malicious app get around the requirement.

hirsin 7y ago
If you force a check at the start, refresh token seems fine. That's much preferable than popping ux every hour or whenever the access token expires.
- couchand 7y ago
  Then what's the point? The malicious app would just keep refreshing so you never see the confirmation again, anyway.