TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Understanding OAuth 2.0 and OpenID Connect

72 pointsby abd12about 7 years ago

2 comments

UncleMeatabout 7 years ago
&gt; The Implicit flow is designed specifically for mobile apps or client side Javascript apps where embedded credentials could be compromised. The mechanics are simple in that the application redirects the user to the Identity Provider to authenticate, the IdP passes back token(s), and the application uses it according to the scopes it has.<p>Do not use Implicit Grant in mobile apps unless interacting with an app provider (and even then, Implicit Grant still has some major footguns if you are using it for authn, which most people are). It was absolutely not &quot;designed specifically for mobile apps.&quot; If you are talking to the browser you cannot ensure that the access token is delivered to the right place and access tokens are not bound to the relying party. If you are using the access token for authn like suggested here, you let malicious apps impersonate your users.<p>If you are using a mobile app and performing OAuth through the browser, use Authz Code flow with PKCE.
评论 #16961787 未加载
评论 #16961504 未加载
评论 #16961671 未加载
billfruitabout 7 years ago
For someone rather new to HN, is there any reason HN, of for that matter reddit do not support logging in with third party accounts? Stackoverflow for example does support them, and whatever may be their downsides, they are mighty convenient.
评论 #16960727 未加载
评论 #16961050 未加载
评论 #16962391 未加载