IETF Logo Mail Archive

[OAUTH-WG] is updated guidance needed for JS/SPA apps?

"Brock Allen" <brockallen@gmail.com> Thu, 17 May 2018 12:57 UTC

Return-Path: <brockallen@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B1C412DA0A for <oauth@ietfa.amsl.com>; Thu, 17 May 2018 05:57:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Level:
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eB9hZ3o1zLJR for <oauth@ietfa.amsl.com>; Thu, 17 May 2018 05:57:01 -0700 (PDT)
Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2C2012D94D for <oauth@ietf.org>; Thu, 17 May 2018 05:57:00 -0700 (PDT)
Received: by mail-qk0-x22e.google.com with SMTP id r28-v6so1193887qkk.4 for <oauth@ietf.org>; Thu, 17 May 2018 05:57:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:date:message-id:subject:from:to:user-agent; bh=AN4GjnOXZic34XS8cTJMFKX+S9U8lk7Z0kcz71QXXNE=; b=ZkJCckl9cGwJmLdI7ISLE+MR8wfsHFbq0s2vOeMX5fsWL1TkyoKGsD6Co2n+sQx14T c9T5nuLjg27uQLRV8FUIAqomVb4nXI2w7BlYOVeTEPWF8PZF1gHhKwhEOBWFpZon9g0F +CUEuIm2L8nTRm6NuFcnodFyV8Jtp899Kvn+ayUGfMusFNgBy1Bzc8ZnsCDksUGpeJXd SwO6sNRKOPs8LKUlEOrHQxpx7xh6ISrefqjcKPPWUb+kdJMDt47MC7qj1QJlgH9lUqp3 caxp5psixtKnk0MwX4LRtigF+Io/KXDXBY0iRyH6tT1vd3ZuK7T2m3CvGf5LDJh0pYi5 WjUg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :user-agent; bh=AN4GjnOXZic34XS8cTJMFKX+S9U8lk7Z0kcz71QXXNE=; b=VbXujIrhX90+qF1zJTbFIkdH0310ase75a3deUKnViA3L1MG6F/8kItajg/ThqYpOT NFmpSAeU6JYRgi7UwI17PCDiUHuyDussrlu4rfXT70iFOhSEDXXovRBNWs1ZImhE3ZJ0 eCXdAC3H1rRPLYvD6o/Lpj0+OgkFB2ZaEad5JiMaeFn+ekmbryyohHqXJNBa1trW+o5j QRvCe4O6TOC6BjikYL7x4z0ZlRm7ALASh4iNv+KvqtOWiJMhCdQJoNpKyShDZSwKRAJ6 8YZS/Gl7/23VXrCQ4gqRnmkiJ+46aTePCdIMkLOp9MelSHou5VyP9L8Tffbx10ekUaMK pOaw==
X-Gm-Message-State: ALKqPwe/h2AlAKAaI1qZB7WaZyBfU48GCKcojNhF2/Vx+h552lFiCJOj tWivOqPiWMlol3/XF4zP7UtV01YR
X-Google-Smtp-Source: AB8JxZrpIRZ5R48OBLLAZ98i7fBLETC4DH+XO+zmcA24Hcvxrl/GdhlDSZjOJCOhauOdgB8RgDjt2g==
X-Received: by 2002:a37:1fc2:: with SMTP id n63-v6mr4632630qkh.8.1526561819114; Thu, 17 May 2018 05:56:59 -0700 (PDT)
Received: from [192.168.0.205] ([66.194.212.163]) by smtp.gmail.com with ESMTPSA id k46-v6sm3872130qta.65.2018.05.17.05.56.57 for <oauth@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 May 2018 05:56:57 -0700 (PDT)
Content-Type: multipart/alternative; boundary="----=_NextPart_55672916.149041615614"
MIME-Version: 1.0
Date: Thu, 17 May 2018 08:56:52 -0400
Message-ID: <ab42d84a-5f08-4600-aa36-92e73944cf6c@getmailbird.com>
From: Brock Allen <brockallen@gmail.com>
To: oauth@ietf.org
User-Agent: Mailbird/2.5.8.0
X-Mailbird-ID: ab42d84a-5f08-4600-aa36-92e73944cf6c@getmailbird.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/lhIUyUpuueJmYMT8FwmIlqp6T2g>
Subject: [OAUTH-WG] is updated guidance needed for JS/SPA apps?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 May 2018 12:57:03 -0000

Much like updated guidance was provided with the "OAuth2 for native apps" RFC, should there be one for "browser-based client-side JS apps"? I ask because google is actively discouraging the use of implicit flow:

https://github.com/openid/AppAuth-JS/issues/59#issuecomment-389639290

>From what I can tell, the complaints with implicit are:
* access token in URL
* access token in browser history
* iframe complexity when using prompt=none to "refresh" access tokens

But this requires:
* AS/OP to support PKCE
* AS/OP to support CORS 
* user-agent must support CORS
* AS/OP to maintain short-lived refresh tokens 
* AS/OP must aggressively revoke refresh tokens at user signout (which is not something OAuth2 "knows" about)
* if the above point can't work, then client must proactively use revocation endpoint if/when user triggers logout

Any use in discussing this?

-Brock

v2.23.0 | Report a Bug | By Email