search

sknebel / AutoAuth

AutoAuth is a WIP extension for IndieAuth without the user being present
13 stars 0 forks source link

remove client_id from Token Request #16

Open sknebel opened 5 years ago

sknebel commented 5 years ago

Putting the client_id here and then requiring to verify it means it's not actually useful here, except maybe to fulfill OAuth expectations that there is a client_id, and potentially dangerous if someone uses it instead of discovering the endpoint independently.

I'd tend toward removing it. (or putting the vallue of me in there?)

https://github.com/sknebel/AutoAuth/blob/master/AutoAuth.md#token-request

sknebel commented 5 years ago

Given that client_id is basically always used for an app, and often (in non-indieauth-land) pre-registered, putting what's now me? in there feels wrong I think.