search

Open-EO / openeo-api

The openEO API specification
http://api.openeo.org
Apache License 2.0
91 stars 11 forks source link

OIDC: Allow auth code flow and device flow for default clients #411

Closed m-mohr closed 3 years ago

m-mohr commented 3 years ago

Fixes/Implements #410.

Could someone verify that my understanding of the authorization_code flow is correct and doesn't require a client_secret?

soxofaan commented 3 years ago

Could someone verify that my understanding of the authorization_code flow is correct and doesn't require a client_secret?

from https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3:

The authorization server MAY accept any form of client authentication meeting its security requirements.

if "any form of client auth" also includes "no client auth", then I guess authorization_code without client_secret/PKCE is indeed allowed