3 ms·
It requires the client id and secret to obtain a refresh token, some also choose to skip this and ask the user to re-authenticate completely. I agree that peop
by nijiko 12y ago
It requires the client id and secret to obtain a refresh token, some also choose to skip this and ask the user to re-authenticate completely.
I agree that people implement it differently so vastly different that it takes almost 40 sources to compile a decent down-to-earth explanation of common practices (same for OAuth 1.0a). However, that doesn't make the protocol bad, it makes the implementation bad, you can avoid XSS, OOS Origin Attacks, and the others with the exception of Vector attacks, but both are vulnerable to this.
- peter_l_downs 12y agoThat's fair, I guess what I'm trying to say is that if the spec leads to broken/vulnerable implementations in the majority of cases there might be reason for concern. One thing I think OAuth 2 gets right is the entire concept of scoped authorization; although not unique to OAuth2, it's now familiar to users largely because Facebook and Google adopted it through OAuth 2.