@aaronpk Thanks for all your very helpful OAuth materials, and especially for your IndieWeb work. Question: A lot of the complexity of OAuth seems to come from avoiding security issues with passing tokens in the address bar ("front channel"). 1/
1
Why not open a new tab for interacting with the auth server, while simultaneously opening a back channel request in the original session? Once the user has authenticated/authorized from the new tab, the back channel request would resolve. 2/
3
That's basically what the Device Flow is, except manual. You certainly could do that. I suspect it would be fragile at best though, and wouldn't work well in mobile browsers.
2
That's interesting. After a quick review, it does seem pretty similar. Why the timeout polling instead of long polling? Does the spec dictate what back-channel you send the user to?
1
Replying to @anderspitman
The spec has a way the AS can provide a URL that the user should visit to the app. So the app has to get the user to that URL somehow, doesn't matter how, and doesn't matter what that URL is.

Jan 21, 2020 · 11:58 PM UTC

1
Replying to @aaronpk
Cool, thanks for the help!