3 ms·
it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticati
by zemnmez 5y ago
it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticating to evilsite.com, the site could use the token its granted to itself log onto another ‘login with HN’ website as the victim. Thats the usual issue with OAuth as login
- rank0 5y agoThanks for pointing this out. Reading your comment just connected some dots in my head about the OAuth flow.
- hardwaresofton 5y agoAh yes, this is something I'm going to tighten up once we have OAuth2 clients signed up -- right now the only client is the actual loginwithhn site itself!