So you're wanting end to end security not relying on TLS?
Have you seen the new draft on protecting codes from interception? Currently called SPOP but needs a different name. On Thursday, November 6, 2014 4:12 AM, Sergey Beryozkin <sberyoz...@gmail.com> wrote: Hi Does it make sense to consider supporting an access token or code wrapping as part of the standard OAuth2 responses ? For example, if a client has registered its public key with AS then say the access token response would contain the regular {"access_token":"1234345"} except that "1234345" would actually be a JWE RSA-OAEP wrapped opaque token with a client's public key being used. Or a direct key encrypted token if the client and the server only share the client secret allocated to the client during the registration. The net result is that only the registered confidential client would be able to extract the actual opaque access token. The response would actually be {"access_token":"1234345", wrapped:true}. I definitely plan to use this approach as a simple mechanism for making a safer distribution of mac keys as part of access token responses; but IMHO it can be handy for minimizing the possibility of the access/refresh tokens or codes being intercepted... Sergey _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth