3 ms·
Aren't the exploits here in not checking that the access token calling you was for you? That is, it wasn't the implicit grant, it was not checking the audience
by taeric 3y ago
Aren't the exploits here in not checking that the access token calling you was for you? That is, it wasn't the implicit grant, it was not checking the audience/signature of the token?
What makes this an implicit grant problems?
- dwaite 3y agoPresumably, a confidential client identifies itself to the AS to exchange a code for an access token, so you know at that point that the access token was meant for that particular client. That said, Facebook Connect is an under-documented vendor extension to OAuth, and only is supported for use via the official SDKs. They do now have a bit more alignment with OpenID Connect and PKCE as an option, but I imagine most existing parties do not use it. https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow https://developers.facebook.com/docs/facebook-login/guides/a...
- taeric 3y agoBut wasn't this a case of the frontend client using harvested tokens from somewhere else?