Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    There are 3 entities involved in OAuth; the user. The authorising server (and the resource server, often the same entity) and 3rd party applications authorised to act on the user's behalf. Now; the 3rd parties are (in author code flow) issued with a client secret/ Client ID. So the question is are specific applications authorised to access data on a users behalf or is (as it sounds like) any application authorised to access data on a users behalf Commented Sep 14, 2015 at 19:50
  • Thanks @RichardTingle (+1), yes, any component must be capable of accessing data on an end user's behalf. Again, the end user will either be a browser (web UI client) or a pure HTTP client (remember the CLI tool uses an HTTP client under the hood). Commented Sep 14, 2015 at 20:01
  • Incident anything not on a server (e.g. a mobile app or a desktop app) shouldn't use the auth code flow because it achieves nothing as the clientID and clientID can be easily obtained by an attacker by decompiling your app Commented Sep 14, 2015 at 20:02
  • Sounds like implicit grant to me that you want then. Commented Sep 14, 2015 at 20:03