Re:Teddit Is Shutting Down
by gizmo686 on Monday July 17, 2023 @04:51PM
(#36763889)
Client_id is spoofable.
Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect.
Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients.
The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.
Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect.
Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients.
The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.