In the previous video, I explained that OAuth’s Resource Owner Password Credentials Grant must not be used except for backward compatibility. I then received a question asking, “Since it is described in RFC6749, isn’t it strange to say that it must not be used?” So, while answering that question, I explained what it means to use it for “backward compatibility.” I hope you enjoy it.
Related posts
OpenAI Launches Sign in with ChatGPT (Based on OpenID Connect)
(Work in progress; last updated 2026-10-02 12:39 JST) On September 29, at DevDay 2026, OpenAI officially announced Sign in with ChatGPT (SIWC). I would like to…
【Announcement】Is That QR Code Safe? Threats and Countermeasures in Cross-Device Authentication and Authorization Flows【YouTube Live】
On August 22 (Thursday), starting at 20 hours, we will host a YouTube Live stream titled “Is That QR Code Safe? Threats and Countermeasures in Cross-Device…
I Heard the Striking Question, “Why Do We Need Access Tokens? Couldn’t We Just Store Passwords?” So Here Is an Explanation
One reader of the ID book asked the striking question, “Why do we need access tokens? Couldn't we just store passwords?” Come to think of it,…