Subject: [OAUTH-WG] same-origin policy

From: Marius Scurtescu <[email-masked]>
Date: Thu, 29 Apr 2010 17:38:58 -0700

Section 3.5.1, version 01, says: "These clients cannot keep client
secrets confidential and the authentication of the client is based on
the user-agent's same-origin policy."

I don't think that the same-origin policy comes into play in this
case. Authentication of the client is based only on the end-user
validating the redirection URI.

Marius

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 30 Apr 2010 08:46:39 -0700

This language was requested by Brian.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Marius Scurtescu
> Sent: Thursday, April 29, 2010 5:39 PM
> To: OAuth WG
> Subject: [OAUTH-WG] same-origin policy
> 
> Section 3.5.1, version 01, says: "These clients cannot keep client secrets
> confidential and the authentication of the client is based on the user-agent's
> same-origin policy."
> 
> I don't think that the same-origin policy comes into play in this case.
> Authentication of the client is based only on the end-user validating the
> redirection URI.
> 
> Marius
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Marius Scurtescu <[email-masked]>
Date: Fri, 30 Apr 2010 17:30:49 -0700

> This language was requested by Brian.

And he is right, my bad. I considered only a narrow definition of same-origin.

Marius