3 ms·
I don't quite get the "let me explain again response_type=code flow". Doesn't seem relevant to the article since the code flow isn't leaking any access token to
by jkrems 14y ago
I don't quite get the "let me explain again response_type=code flow". Doesn't seem relevant to the article since the code flow isn't leaking any access token to the client side at all. Though the solution of making the redirect_uri explicit seems pretty good for the original problem.
- homakov 14y agoit is relevant — for Stolen Credentials threat. if you have creds you can obtain access token for ANY redirect_uri, even for leaking. if it would be static it would not be possible to leak it at all