Hi
Does it make sense to consider supporting an access token or code
wrapping as part of the standard OAuth2 responses ?
For example, if a client has registered its public key with AS then say
the access token response would contain the regular
{"access_token":"1234345"}
except that "1234345" would actually be a JWE RSA-OAEP wrapped opaque
token with a client's public key being used. Or a direct key encrypted
token if the client and the server only share the client secret
allocated to the client during the registration.
The net result is that only the registered confidential client would be
able to extract the actual opaque access token. The response would
actually be
{"access_token":"1234345", wrapped:true}.
I definitely plan to use this approach as a simple mechanism for making
a safer distribution of mac keys as part of access token responses; but
IMHO it can be handy for minimizing the possibility of the
access/refresh tokens or codes being intercepted...
Sergey
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
