To: oauth <oauth@ietf.org>
From: Jared L Jennings <jaredljennings@gmail.com>
Organization: Ninja Tools
Message-ID: <c95d2c0f-3a19-8743-06a6-3b6b34fc0fcd@gmail.com>
Date: Wed, 20 May 2020 22:43:13 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
 Gecko/20100101 Thunderbird/68.8.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="------------0CC581FCD4977ED7A9C2438E"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/BHlU2ZjGLbhDqh5TMfLRn1TSKTU>
Subject: [OAUTH-WG] Questions about oauth-browser-based-apps-06
Precedence: list

This is a multi-part message in MIME format.
--------------0CC581FCD4977ED7A9C2438E
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

I'm surprised that this is OK. Why is this safe or a best practice?

    /The Application Server can store the access token either server-side, /
    /or in the cookie itself./


What are appropriate browser APIs? (Maybe providing some guidance or a 
hint regarding this?)

    /The JavaScript app is then responsible for storing the access token /
    /(and optional refresh token) securely using appropriate browser APIs./


Can the access token be included the various (all) available transport 
methods? Query string, Header, Post, etc.

/When the JavaScript application in the browser wants to make a request 
to the Resource Server, it can include the access token in the request 
(D) and make the request directly./


Thanks,

-- 
-----
Jared L Jennings
816.678.4152
Skype: jaredljennings


--------------0CC581FCD4977ED7A9C2438E
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p><font face="Helvetica, Arial, sans-serif">I'm surprised that this
        is OK. Why is this safe or a best practice?</font><br>
    </p>
    <blockquote><i>The Application Server can store the access token
        either server-side, </i><br>
      <i>or in the cookie itself.</i><br>
    </blockquote>
    <p><br>
    </p>
    <p><font face="Helvetica, Arial, sans-serif">What are appropriate
        browser APIs? (Maybe providing some guidance or a hint regarding
        this?)</font></p>
    <blockquote><i>The JavaScript app is then responsible for storing
        the access token </i><br>
      <i>(and optional refresh token) securely using appropriate browser
        APIs.</i><br>
    </blockquote>
    <br>
    <font face="Helvetica, Arial, sans-serif">Can the access token be
      included the various (all) available transport methods? Query
      string, Header, Post, etc.</font>
    <pre class="newpage" style="font-size: 13.3333px; margin-top: 0px; margin-bottom: 0px; break-before: page; color: rgb(0, 0, 0); font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"><i>   When the JavaScript application in the browser wants to make a
   request to the Resource Server, it can include the access token in
   the request (D) and make the request directly.</i>
</pre>
    <p><br>
    </p>
    Thanks,<br>
    <pre class="moz-signature" cols="72">-- 
-----
Jared L Jennings
816.678.4152
Skype: jaredljennings</pre>
  </body>
</html>

--------------0CC581FCD4977ED7A9C2438E--