Understanding OAuth 2.0 and OpenID Connect

Re:Understanding OAuth 2.0 and OpenID Connect by UncleMeat on Monday April 30, 2018 @02:43PM (#16961125)

> The Implicit flow is designed specifically for mobile apps or client side Javascript apps where embedded credentials could be compromised. The mechanics are simple in that the application redirects the user to the Identity Provider to authenticate, the IdP passes back token(s), and the application uses it according to the scopes it has.

Do not use Implicit Grant in mobile apps unless interacting with an app provider (and even then, Implicit Grant still has some major footguns if you are using it for authn, which most people are). It was absolutely not "designed specifically for mobile apps." If you are talking to the browser you cannot ensure that the access token is delivered to the right place and access tokens are not bound to the relying party. If you are using the access token for authn like suggested here, you let malicious apps impersonate your users.

If you are using a mobile app and performing OAuth through the browser, use Authz Code flow with PKCE.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by adumbledore on Monday April 30, 2018 @04:08PM (#16961787)

It even says so on the official website ( https://oauth.net/2/grant-types/implicit/ ) - astonishing that they can't get this right. Maybe says something about the product?

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by UncleMeat on Monday April 30, 2018 @05:52PM (#16962765)

Yep. I'm fairly concerned about an identity management company publishing this information.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by caseysoftware on Monday April 30, 2018 @09:47PM (#16964047)

Author here -

Entirely agree and we recommend using Auth Code+PKCE whenever possible. This post is intended to be the first of a few starting with the base spec. In the next one, I plan to go over the RFCs for JWT, Revocation, Inspection, PKCE, the AppAuth pattern, and probably a few others.

Thanks for the note though.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by rahulrav on Tuesday May 01, 2018 @08:11AM (#16966326)

Thanks for the shoutout to AppAuth (https://appauth.io). It’s our 20% project at Google.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by idubrov on Monday April 30, 2018 @03:31PM (#16961504)

I wonder if the same recommendation (use Authorization Code Grant flow plus PKCE instead of Implicit Grant) should be made for SPA (single page applications), too.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by rdegges on Monday April 30, 2018 @03:50PM (#16961662)

Unfortunately, most SPA apps don't have a server side backed and thus cannot benefit from the additional security that the Authorization Code flow provides.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by idubrov on Monday April 30, 2018 @04:47PM (#16962172)

They are in the same category as mobile apps in that respect, no? Both of them are "public clients" in terms of OAuth 2.0.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by rdegges on Monday April 30, 2018 @03:51PM (#16961671)

I'd actually add that implicit should never be used for mobile app unless you have no backend whatsoever.

[ Parent | on HN ]

Re:Understanding OAuth 2.0 and OpenID Connect by UncleMeat on Monday April 30, 2018 @05:55PM (#16962779)

Even then you should still use authz with pkce. At the very least nobody else should be able to get your access token. For some workflows this is all the guarantee you need.

[ Parent | on HN ]