Subject: [OAUTH-WG] New OAuth for Browser-Based Apps draft -04

From: Aaron Parecki <[email-masked]>
Date: Thu, 26 Sep 2019 15:45:53 +0200

Hi all,

I've revised the browser-based apps draft to take into account
everything discussed at the previous IETF meeting in Montreal.

https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04

Here's a summary of the changes:

* Disallow the password grant to bring it inline with the Security BCP
* Rewrote the section about refresh tokens to allow refresh tokens if
they are time-limited or rotated on each use
* Updated the same-domain JS architecture section to focus more on the
design pattern than the domain aspect
* Added a few more references to the Security BCP

This addresses all of the feedback from the session except for the one
open item we had, which was to somehow describe that in some cases an
access token will be sent down to the browser, and what to keep in
mind when that is the case. This still needs some discussion on the
list here.

Please give it a read and let me know what you think! I think this is
shaping up quite nicely now.

----
Aaron Parecki
aaronparecki.com