Remove obsolete / insecure OAuth2 flows from this spec

buildingSMART / foundation-API

Shared elements in the diverse API standards

34 stars 8 forks source link

Open GeorgDangl opened 3 years ago

GeorgDangl commented 3 years ago

implicit_grant, which has been effectively deprecated, or at least it's usage is heavily discouraged
resource_owner_password_credentials_grant, which never really was considered secure in scenarios where you did not control all services involved

This was brought up in the meeting today, and we should just remove it from the spec completely.

ykulbak commented 1 year ago

Sep 25th 2023. See discussion on generalising OAUTH flows to avoid banning supported features on https://github.com/buildingSMART/foundation-API/issues/25 (same date).