Re: [OAUTH-WG] User-agent flow and pre-registered redirect_uri

Rick, ...

On Sat, Jun 5, 2010 at 12:45 PM, Rick Olson <technoweenie@gmail.com> wrote:

> How else are you preregistered with the auth server?

I don't understand the question, sorry.

>  Why can't you
> just return the temporary code and rely on the JS or Desktop app to
> make another call to get the access token?  JSONP would work well for
> the response to JS apps.
>
Besides being less convenient for the clients, what would that accomplish?
I don't think it would improve security, if that's the objective, since the
clients still can't keep their own secrets and it's the secret that
accompany the follow-up request for an access token that prevent the
security problem in the other flows.

>
> On Sat, Jun 5, 2010 at 12:49 AM, Andrew Arnott <andrewarnott@gmail.com>
> wrote:
> > The user agent flow indicates that the redirect_uri SHOULD be
> preregistered
> > with the auth server for a given client.  I would like to suggest that
> the
> > SHOULD here be changed to MUST.  Unless I'm missing something, without a
> > preregistered redirect_uri any arbitrary client can obtain an access
> token
> > under the pretense of being another client, and thereby perhaps
> altogether
> > skip a user authorization prompt.
> >
> > As there will likely be a few popular client_id's in use, it will
> actually
> > make it trivially easy to obtain elevated access to private user data as
> a
> > rogue application.  This danger is unique to the user-agent flow because
> in
> > this flow the client_secret is not required to obtain the access token,
> > whereas it is for other flows.
> >
> > Thoughts?
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the
> death
> > your right to say it." - S. G. Tallentyre
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth
> >
> >
>
>
>
> --
> Rick Olson
>