In the previous video, I explained that OAuth’s Resource Owner Password Credentials Grant must not be used except for backward compatibility. I then received a question asking, “Since it is described in RFC6749, isn’t it strange to say that it must not be used?” So, while answering that question, I explained what it means to use it for “backward compatibility.” I hope you enjoy it.
Related posts
When Should OAuth’s Password Grant Be Used? [2-Minute OAuth Lesson]
OAuth has something called the “Resource Owner Password Credential (ROPC) Grant.” In fact, some banks use it, and I occasionally receive questions from developers who…
OAuth PKCE Published as RFC7636
OAuth PKCE (pronounced “pixy”), for which John Bradley (Ping), Naveen Agarwal (Google), and I are credited as co-authors, has been published as [RFC 7636]. It was…
Using Plain OAuth 2.0 for Authentication Opens a Security Hole Big Enough to Drive a Car Through
Using the OAuth 2.0 implicit grant flow for authentication opens a security hole big enough to drive a car through, as explained in this excellent article…