Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-browser-based-apps-11.txt

Hello all,

With the help of a few kind folks, we've made some updates to this draft as
discussed during the last IETF meeting in Philadelphia.

You can find the current version, draft 11, here:
https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-11.html

The major changes in this version are adding two new architecture patterns,
the "Token Mediating Backend" pattern based on the TMI-BFF draft, and the
"Service Worker" pattern of using a Service Worker as the OAuth client.
I've also done a fair amount of rearranging of various parts of the
document to hopefully make more sense.

Obviously there is no clear winner in terms of which architecture pattern
is best, so instead of trying to make a blanket recommendation, the goal of
this draft is to document the pros and cons of each. If you have any input
into either benefits or drawbacks that aren't mentioned yet in any of the
patterns discussed, please feel free to chime in so we can add them to the
document! You're welcome to either reply on the list, open an issue on the
linked GitHub repository, or contact me directly. Keep in mind that only
comments on the mailing list are part of the official record.

Thanks,

Aaron Parecki

On Tue, Sep 13, 2022 at 10:42 AM <internet-drafts@ietf.org> wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Web Authorization Protocol WG of the IETF.
>
>         Title           : OAuth 2.0 for Browser-Based Apps
>         Authors         : Aaron Parecki
>                           David Waite
>   Filename        : draft-ietf-oauth-browser-based-apps-11.txt
>   Pages           : 29
>   Date            : 2022-09-13
>
> Abstract:
>    This specification details the security considerations and best
>    practices that must be taken into account when developing browser-
>    based applications that use OAuth 2.0.
>
> Discussion Venues
>
>    This note is to be removed before publishing as an RFC.
>
>    Discussion of this document takes place on the Web Authorization
>    Protocol Working Group mailing list (oauth@ietf.org), which is
>    archived at https://mailarchive.ietf.org/arch/browse/oauth/.
>
>    Source for this draft and an issue tracker can be found at
>    https://github.com/oauth-wg/oauth-browser-based-apps.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-oauth-browser-based-apps/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-11.html
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-browser-based-apps-11
>
>
> Internet-Drafts are also available by rsync at rsync.ietf.org:
> :internet-drafts
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>