4 ms·
Doesn't that issue come from the fact that OAuth2 state mostly lives in GET URL data (redirects/callbacks) and request headers (bearer tokens), vs. POST body (w
by q3k 6y ago
Doesn't that issue come from the fact that OAuth2 state mostly lives in GET URL data (redirects/callbacks) and request headers (bearer tokens), vs. POST body (which is something OAuth3 does seem to get right)?
- marcosdumay 6y agoYes, and the move into references is a very welcome one. It will solve one of the large bottlenecks for OAuth use. Still, I'm not sure using references in the crypto data itself is a good thing. You will get more requests, more infrastructure dependency, more metadata tracking, for fixing the bloat of a minor (in size) part of the protocol, and getting cryptographic agility, that is a disagreeable feature at best. Also, once they have references, why are they adding polymorphism too? Polymorphism is a hack that tries (but fails) to solve the same problem.
- q3k 6y agoI agree with your points :). IIUC the 'JSON polymorphism' exists _to_ support handles - so that a field `foo` may either contain directly an object as data, or a string as a handle to that data.
- Pet_Ant 6y ago> It will solve one of the large bottlenecks for OAuth use. Sorry, which bottleneck is that?
- marcosdumay 6y agoIt breaking at random due to network middle man.