3 ms·
The question here is: who is responsible for user behavior, the user or the application? If the user is solely responsible then just using client tokens is fine
by rabidsnail 14y ago
The question here is: who is responsible for user behavior, the user or the application? If the user is solely responsible then just using client tokens is fine, because you can ban the user by invalidating her tokens. But how to you ban an app? There's no good way to solve that problem if everything is client side.
- AshFurrow 14y agoThe Stack Overflow question I link to offers an interesting point: OAuth would work fine if tokens and secrets were passed out on a per-app, per-install basis. That way you could ban a developer of an app, or an individual, if their token/secret combo becomes compromised. Something like federated key management: http://www.scmagazine.com/federated-key-management-as-the-basis-for-secure-cloud-computing/article/158089/ http://www.scmagazine.com/federated-key-management-as-the-ba...
- bri3d 14y agoThe problem is that to do per-install tokens, one needs a secure side channel between the server and client over which to exchange these tokens, or a secure side channel to some kind of key management/federation server. That's fine and good, but it completely defeats the point of OAuth 1, which was to provide a request signing method that didn't depend on any other secure side-channels to operate. With OAuth 2, of course, the point is mooted a bit by the decision to go with HTTPS as the secure channel, and such a scheme seems much more plausible.