Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-11479

OAuth 2: Do not allow implicit flow by default for Confidential clients

    Details

    • Type: Improvement
    • Status: Open
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: oauth2, OpenID Connect
    • Labels:

      Description

      Currently if you register an OAuth 2.0 Confidential client (i.e., one that has client credentials) then by default it has a set of allowed response types that includes the various implicit flows: "token", "id_token" and the various hybrid flows like "code id_token".

      These flows do not require client authentication to obtain an access token and/or id token, despite the fact that the client is capable of it. This is probably not a configuration that anyone actually wants.

      The spec is silent on whether this should be allowed or not, and there may be some valid reason for wanting this. However, this should probably be an opt-in rather than opt-out situation, as if you leave the settings as their defaults you end up with a questionable security setting.

      I suggest we change the default response types to just "code" and require clients to explicitly add the other flows if they want them.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                neil.madden Neil Madden
              • Votes:
                0 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                • Created:
                  Updated: