To: oauth@ietf.org
References: <1e63222f-1d3b-59cc-a7c3-f9f3aa14e9df@manicode.com>
From: Bill Burke <bburke@redhat.com>
Message-ID: <5d69eb72-b99a-1605-b58b-b7f33bb5db60@redhat.com>
Date: Thu, 16 Feb 2017 18:13:38 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0)
 Gecko/20100101 Thunderbird/45.7.1
MIME-Version: 1.0
In-Reply-To: <1e63222f-1d3b-59cc-a7c3-f9f3aa14e9df@manicode.com>
Content-Type: multipart/alternative;
 boundary="------------3CBF49A545BE0997C6BB9517"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/eoaTn4wj3-FwyvSpPNUxl0fkjhc>
Subject: Re: [OAUTH-WG] Google's use of Implicit Grant Flow
Precedence: list

This is a multi-part message in MIME format.
--------------3CBF49A545BE0997C6BB9517
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit

For our IDP [1], our javascript library uses the auth code flow, but 
requires a public client, redirect_uri validation, and also does CORS 
checks and processing.  We did not like Implicit Flow because

1) access tokens would be in the browser history

2) short lived access tokens (seconds or minutes) would require a 
browser redirect

I'd be really curious to hear other's thoughts though.

[1] http://keycloak.org




On 2/16/17 5:44 PM, Jim Manico wrote:
>
> Hello Folks,
>
> I noticed that Google supports the OAuth 2 Implicit flow for 
> third-party JavaScript applications.
>
> https://developers.google.com/identity/protocols/OAuth2UserAgent
>
> Isn't this generally discouraged from a security POV? *Is there a 
> better OAuth 2 flow for third party SPA applications?*
>
> Aloha,
> -- 
> Jim Manico
> Manicode Security
> https://www.manicode.com
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth


--------------3CBF49A545BE0997C6BB9517
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>For our IDP [1], our javascript library uses the auth code flow,
      but requires a public client, redirect_uri validation, and also
      does CORS checks and processing.  We did not like Implicit Flow
      because</p>
    <p>1) access tokens would be in the browser history</p>
    <p>2) short lived access tokens (seconds or minutes) would require a
      browser redirect</p>
    <p>I'd be really curious to hear other's thoughts though.<br>
    </p>
    <p>[1] <a class="moz-txt-link-freetext" href="http://keycloak.org">http://keycloak.org</a></p>
    <p><br>
    </p>
    <p><br>
    </p>
    <br>
    <div class="moz-cite-prefix">On 2/16/17 5:44 PM, Jim Manico wrote:<br>
    </div>
    <blockquote
      cite="mid:1e63222f-1d3b-59cc-a7c3-f9f3aa14e9df@manicode.com"
      type="cite">
      <meta http-equiv="content-type" content="text/html;
        charset=windows-1252">
      <p>Hello Folks,</p>
      <p>I noticed that Google supports the OAuth 2 Implicit flow for
        third-party JavaScript applications.</p>
      <p><a moz-do-not-send="true" class="moz-txt-link-freetext"
          href="https://developers.google.com/identity/protocols/OAuth2UserAgent">https://developers.google.com/identity/protocols/OAuth2UserAgent</a></p>
      <p>Isn't this generally discouraged from a security POV? <b>Is
          there a better OAuth 2 flow for third party SPA applications?</b><br>
      </p>
      Aloha,<br>
      <pre class="moz-signature" cols="72">-- 
Jim Manico
Manicode Security
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.manicode.com">https://www.manicode.com</a></pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
OAuth mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OAuth@ietf.org">OAuth@ietf.org</a>
<a class="moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/oauth">https://www.ietf.org/mailman/listinfo/oauth</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------3CBF49A545BE0997C6BB9517--