Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow?
Dominick Baier <dbaier@leastprivilege.com> Wed, 19 February 2020 06:49 UTC
Return-Path: <dbaier@leastprivilege.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F41D01208A3 for <oauth@ietfa.amsl.com>; Tue, 18 Feb 2020 22:49:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=leastprivilege-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gTCXDv_btPKh for <oauth@ietfa.amsl.com>; Tue, 18 Feb 2020 22:49:07 -0800 (PST)
Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B7321200D5 for <oauth@ietf.org>; Tue, 18 Feb 2020 22:49:07 -0800 (PST)
Received: by mail-qk1-x735.google.com with SMTP id a2so22022262qko.12 for <oauth@ietf.org>; Tue, 18 Feb 2020 22:49:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leastprivilege-com.20150623.gappssmtp.com; s=20150623; h=from:in-reply-to:references:mime-version:date:message-id:subject:to; bh=KZQbjZntqDTcgDDWuyE8kHeXolkRST7bFBGp60T8AaM=; b=MsOTdH2CsgwE5T6HVCFdgumDxnlQLJdK5fvGB9G2BHdq+eq6EUwu0y4SoLMPwaQVPh Vm+5N+Hf5S1WR6rNLaNnfX+h4oSuEHHK9ucv3sOQquONVgQ24+hMV/Ok1fg2oY3t+877 ubND+d0Q9G8yE7PkkySuqri4asS2o1hGEReO3UDpuI1t4QNfQIDmmBKsccrjVd+9vhPK o9nU76Ee3/M/ALLfS0DF3VQihJjyWFqGlFfo5X24ieiR0TN6Q5u4kQoySJLPJo+fWvb0 HTluelawjbIW6X/r3onYxJddVVgQRjFNuoJ8jWjrdTCfS1c5bhwWMtsxbn8d5jCvo2Ac M5jQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:in-reply-to:references:mime-version:date :message-id:subject:to; bh=KZQbjZntqDTcgDDWuyE8kHeXolkRST7bFBGp60T8AaM=; b=jcgSJm7pXrQpADFj+9qWX9EkuwaE6h056dgZl0FmiGk39mkd0HMy3gsb7sqMP8R1o6 Ux2XZWLPwK0i3dGuwApPbgpk6znP36+ymLYQJL4NEt2ZuJ8cvZO4bRaHgRbOWCcsgDCo c0aalHrjbUxNMggzbj0/rUjwgGOq+l83nzdeZiQlURZzL0iTeppLBy6p1vpNhZ4V2Z0g YoHK/xcbcCivsCd/ABm0M1duBoOuFguTjXJpqkjw6a2htYMGybZmjPdsPxp4WV2tj7BZ Imj8ZAwj3dmVBFcqy+SJ8CuxZuQkZR0t4k7hOg3Ui3/gIsWwlATj1kXc3KhBr2ZQ4GXE rMgA==
X-Gm-Message-State: APjAAAUGfpiYzEke/wub1UHBGFORgHrSKRJMPy/Jm5Cs11zOMI4q9Tuh FX5uvM/3Gq7K6tU16XlLN+0wOXSO67zr5akmb45w
X-Google-Smtp-Source: APXvYqxZA1PFVe9FTvUTvECAtBLuhAqQnIACZ+Jon2SURoKmyIXoyDPGM+W7co4pKzeoawR9kiXSc8tnGKFX+C4x/gA=
X-Received: by 2002:ae9:f009:: with SMTP id l9mr22387112qkg.259.1582094946525; Tue, 18 Feb 2020 22:49:06 -0800 (PST)
Received: from 1058052472880 named unknown by gmailapi.google.com with HTTPREST; Tue, 18 Feb 2020 22:49:05 -0800
From: Dominick Baier <dbaier@leastprivilege.com>
In-Reply-To: <CAD9ie-u+egKriB1nvm9CtvFgp4cY1j6sNykGVuTTpsyvR5hA2Q@mail.gmail.com>
References: <CAD9ie-u+egKriB1nvm9CtvFgp4cY1j6sNykGVuTTpsyvR5hA2Q@mail.gmail.com>
MIME-Version: 1.0
Date: Tue, 18 Feb 2020 22:49:05 -0800
Message-ID: <CAO7Ng+tUPVfVXQs5MpnO4z5F25WimX-1qeCmLQfrD0Yhbj-ysA@mail.gmail.com>
To: Dick Hardt <dick.hardt@gmail.com>, oauth@ietf.org
Content-Type: multipart/alternative; boundary="0000000000004a02ec059ee82f22"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/qnMVFsRCV9Owoubs7rPCi1Yyh6A>
Subject: Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Feb 2020 06:49:10 -0000
No - please get rid of it. ——— Dominick Baier On 18. February 2020 at 21:32:31, Dick Hardt (dick.hardt@gmail.com) wrote: Hey List (I'm using the OAuth 2.1 name as a placeholder for the doc that Aaron, Torsten, and I are working on) Given the points Aaron brought up in https://mailarchive.ietf.org/arch/msg/oauth/hXEfLXgEqrUQVi7Qy8X_279DCNU Does anyone have concerns with dropping the implicit flow from the OAuth 2.1 document so that developers don't use it? /Dick _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dominick Baier
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Brian Campbell
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Brian Campbell
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Brian Campbell
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Torsten Lodderstedt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Vittorio Bertocci
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Jared Jennings
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Justin Richer
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Jared Jennings
- Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow? Dick Hardt