Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Documentation Error: Implicit Grant is being depreciated in favor of Authorization Code + PKCE #794

Open
Xpyder opened this issue Dec 8, 2021 · 1 comment

Comments

@Xpyder
Copy link
Contributor

Xpyder commented Dec 8, 2021

Describe the bug
on https://oauthlib.readthedocs.io/en/latest/oauth_1_versus_oauth_2.html

the entry for
Your clients reside in user controlled devices with the ability to authorize through a web based workflow. This workflow is inherently insecure, restrict the privileges associated with tokens accordingly.
suggests to use Implicit Grant, but Implicit Grant is now considered to be unacceptably insecure and is being depreciated in favor of Authorization Code with PKCE

How to reproduce

Go to the page, read the section, compare to the official documentation linked below

Expected behavior

the document should match the official recommendation

Additional context
https://oauth.net/2/grant-types/implicit/ (includes several further reading links at the bottom)
https://oauth.com/playground/index.html (choose implicit flow and read the content of step 2)

@JonathanHuot
Copy link
Member

Hi @Xpyder , you're right , this section deserves a little bit of refactoring following new security best practices. Any PR by chance ? (you can test your changes before commit by executing tox -e docs !)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants