Re: [OAUTH-WG] questions about implicit grant

[John Joseph Bachir <[e-mail]>]

Thanks Justin - some more questions below...



> > What does "public" mean here? In what sense could a client be
> > public or private, and why is implicit grant more appropriate for the
> > public case?
>
> Section 2.1, client types.
>

My understanding of a public client from this section was a client which is
distributed and not hosted on a server, such as a desktop or mobile app.
How is it possible for a web-hosted client to be public?


Step C is the server sending back the HTTP redirect in response to step
> A. Steps D, and E are the user agent following that HTTP redirect. Step
> F is extracting the information from the redirected endpoint. While the
> access token is sent back in step C, scripts running in the user agent
> don't have easy access to it.


Ah whoops, I misread C and D. So here's my real question: Why doesn't the
user agent send the access token to the server in D? Why does the web
server have to deliver a script which extracts it locally? Is it to
facilitate a certain style of applications development?