News for hackers. Stuff that matters.

A comment on Understanding OAuth 2.0 and OpenID Connect. Parent comment

Re:Understanding OAuth 2.0 and OpenID Connect by rdegges on Monday April 30, 2018 @03:51PM (#16961671)
I'd actually add that implicit should never be used for mobile app unless you have no backend whatsoever.
[ Parent | on HN ]
Re:Understanding OAuth 2.0 and OpenID Connect by UncleMeat on Monday April 30, 2018 @05:55PM (#16962779)
Even then you should still use authz with pkce. At the very least nobody else should be able to get your access token. For some workflows this is all the guarantee you need.
[ Parent | on HN ]