search

oauth-wg / oauth-v2-1

OAuth 2.1 is a consolidation of the core OAuth 2.0 specs
https://oauth.net/2.1/
Other
53 stars 27 forks source link

Require authorization endpoint to be accessible by the user agent #79

Closed aaronpk closed 3 years ago

aaronpk commented 3 years ago

See this thread for context:

https://mailarchive.ietf.org/arch/msg/oauth/I9v_RvsGDHbfIpqwnH4vLXlTCls/

Could be worded to either require the authorization endpoint be "publicly accessible" (for whatever "public" means tho that might be tricky), or to be accessible by the user agent with no other form of authentication needed, or specifically prohibit known lists of things like MTLS.

dickhardt commented 3 years ago

Unclear why we would prohibit MTLS. The browser could be using MTLS to with the authorization endpoint.