Re: [OAUTH-WG] User-Agent flow and refresh tokens

2010-09-19 Thread Torsten Lodderstedt
Am 18.09.2010 01:28, schrieb Kris Selden: Secrets on native apps are good! The key is (no pun intended) that the secret not ship with the app. Each client should register for its own client_id and secret when it is installed on the client machine. Maybe I'm missing something but... If it

Re: [OAUTH-WG] User-Agent flow and refresh tokens

2010-09-17 Thread Kris Selden
Secrets on native apps are good! The key is (no pun intended) that the secret not ship with the app. Each client should register for its own client_id and secret when it is installed on the client machine. Maybe I'm missing something but... If it has no credentials, why does sending it

Re: [OAUTH-WG] User-Agent flow and refresh tokens

2010-09-16 Thread Marius Scurtescu
On Thu, Sep 16, 2010 at 12:00 PM, Torsten Lodderstedt tors...@lodderstedt.net wrote: I don't know whether I understand you correctly. Are you saying that refresh tokens only make sense in Web servers? I was referring to the web server flow/profile. Not web servers in general. Why would a

Re: [OAUTH-WG] User-Agent flow and refresh tokens

2010-09-15 Thread Torsten Lodderstedt
Am 16.09.2010 um 05:53 schrieb Andrew Arnott andrewarn...@gmail.com: The user agent flow works for native apps that can host a web browser. It works pretty well in my experience. Would like to see support for refresh tokens in this flow? Secrets on native apps are good! The key is (no pun