[OAUTH-WG] can public clients be as safe in Auth Code Grants?

Bill Burke <bburke@redhat.com> Tue, 04 March 2014 16:56 UTC

Message-ID: <531604CC.5020409@redhat.com>
Date: Tue, 04 Mar 2014 11:52:28 -0500
From: Bill Burke <bburke@redhat.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
MIME-Version: 1.0
To: oauth <oauth@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/csZyrtmXspClyHhMdrFtVVnwUA4
Subject: [OAUTH-WG] can public clients be as safe in Auth Code Grants?
Precedence: list

Section 3.2.1 talks about the need for and benefits of confidential 
clients.  For Auth Code Grants, can't public clients be as safe as 
confidential clients if:

* HTTPS is being used for all communication
* Valid redirect_uri patterns are registered at the Auth Server for the 
public clients
* Auth server validates the client's redirect_uri when processing a 
Authorization Request.  The browser would ensure you are redirecting to 
a valid domain.
* "state" parameter is validated by the client from the Authorization 
Response.
* Client sends its "client_id" and "redirect_uri" when making a Access 
Token Request
* Auth server revalidates "client_id", "redirect_uri" to data used to 
create the Auth Code.


Nobody could fake being the public client because an auth code could 
only be sent to the registered redirect URLs of the public client.

As for the statement that it might be easier to change client 
credentials than to revoke refresh tokens, couldn't his also be 
mitigated if the Auth Server supported setting a revocation policy for 
the client?

Thanks in advance.

Bill

p.s. FYI, maybe I did something wrong, but I couldn't seem to get 
anything posted on the Google Group for OAuth.  Hope its ok to post 
these kinds of questions here.

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

[OAUTH-WG] can public clients be as safe in Auth … Bill Burke