Subject: [OAUTH-WG] Implicit Grant Client Authentication

From: "Craig Heath" <[email-masked]>
Date: Thu, 10 Mar 2011 10:33:25 -0800

I'm sure this has been gone over before, so apologies for that, but I haven't found a clear answer (is there a better way than just Google to search the mailing list archive, by the way?)

I've been puzzling over this text in 4.2: "... the authentication of the client is based on the user-agent's same-origin policy."

I get that the client can't be provisioned with secret credentials and that's why we're using this flow, but I'm puzzled by the implication that it might still be possible to authenticate the client.  Isn't the point of this flow that you can't?

Specifically, how would you verify that the request is coming from a user agent that even has a same-origin policy?

Thanks!

- Craig.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 11 Mar 2011 10:24:16 +0100

Hi Craig,

> I've been puzzling over this text in 4.2: "... the authentication of  
> the client is based on the user-agent's same-origin policy."

I consider this a a relict from the original User-Agent Flow  
description. This flow was dedicated to JavaScript apps running  
embedded in a webpage.

>
> I get that the client can't be provisioned with secret credentials  
> and that's why we're using this flow, but I'm puzzled by the  
> implication that it might still be possible to authenticate the  
> client.  Isn't the point of this flow that you can't?

Such a client can be validated based on its redirect URI if this URI  
(or the base URI) has been registered previously.

>
> Specifically, how would you verify that the request is coming from a  
> user agent that even has a same-origin policy?

Good question :-)!

regards,
Torsten.
>
> Thanks!
>
> - Craig.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 24 Mar 2011 15:46:37 -0700

This line was left over from an earlier draft. It's now removed. It may reappear in the security considerations section.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Craig Heath
> Sent: Thursday, March 10, 2011 10:33 AM
> To: [email-masked]
> Subject: [OAUTH-WG] Implicit Grant Client Authentication
> 
> I'm sure this has been gone over before, so apologies for that, but I haven't
> found a clear answer (is there a better way than just Google to search the
> mailing list archive, by the way?)
> 
> I've been puzzling over this text in 4.2: "... the authentication of the client is
> based on the user-agent's same-origin policy."
> 
> I get that the client can't be provisioned with secret credentials and that's
> why we're using this flow, but I'm puzzled by the implication that it might still
> be possible to authenticate the client.  Isn't the point of this flow that you
> can't?
> 
> Specifically, how would you verify that the request is coming from a user
> agent that even has a same-origin policy?
> 
> Thanks!
> 
> - Craig.
>