Subject: Re: [OAUTH-WG] postmessage communication in -security-topics-13

From: Travis Spencer <[email-masked]>
Date: Sun, 1 Mar 2020 14:47:10 +0100

On Tue, Dec 24, 2019 at 12:27 AM Brian Campbell
<bcampbell=[email-masked]> wrote:
>
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4.3.2 has "Replace implicit flow with postmessage communication or ..." but without a defined and interoperable way of using postmessage communication in place of the implicit flow that "proposed countermeasure" seems a problematic suggestion..

The WG could pick up
https://datatracker.ietf.org/doc/draft-ideskog-assisted-token/