<div><div dir="auto">I am not talking about SPA. </div></div><div dir="auto">The client is a regular confidential client that is running on a server. </div><div dir="auto"><br></div><div dir="auto">Best, </div><div dir="auto"><br></div><div dir="auto">Nat Sakimura</div><div dir="auto"><br></div><div><br><div class="gmail_quote"><div dir="ltr">2018年11月27日(火) 16:55 Jim Manico <<a href="mailto:jim@manicode.com">jim@manicode.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Nat,</p>
<p>How is proof of possession established in a modern web browser in
the implicit flow?</p>
<p>My understanding is that token binding was removed from Chrome
recently effectively killing browser-based PoP tokens.<br>
</p>
<p><a class="m_3198703036183061011moz-txt-link-freetext" href="https://identiverse.com/2018/10/31/chrome-puts-token-binding-in-a-bind/" target="_blank">https://identiverse.com/2018/10/31/chrome-puts-token-binding-in-a-bind/</a></p>
<p>Am I missing something?</p>
<p>Aloha, Jim</p>
<p><br>
</p>
<div class="m_3198703036183061011moz-cite-prefix">On 11/27/18 9:00 PM, Nat Sakimura
wrote:<br>
</div>
<blockquote type="cite">
<div>
<div dir="auto">I am actually -1. </div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">+1 for public client and the tokens that are not
sender/key constrained. </div>
<div dir="auto"><br>
</div>
<div dir="auto">Just not being used right now does not mean that
it is not useful.. In fact, I see it coming. </div></blockquote></div><div text="#000000" bgcolor="#FFFFFF"><blockquote type="cite">
<div dir="auto">Implicit (well, Hybrid “token id_token” really) is
very useful in certain cases. </div>
<div dir="auto">Specifically, when the client is confidential
(based on public key pair), and uses sender constrained
(key-constrained) token such as the one explained in <a href="https://tools.ietf.org/html/draft-sakimura-oauth-jpop-04#section-5" target="_blank">https://tools.ietf.org/html/draft-sakimura-oauth-jpop-04#section-5</a>,
it is very useful. </div>
<div dir="auto">(Key-constrained token is the remaining portion of
this draft that did not get incorporated in the MTLS draft. )</div>
<div dir="auto">In fact it is the only viable method for
Self-Issued OpenID Provider. </div>
<div dir="auto"><br>
</div>
<div dir="auto">So, the text is generally good but it needs to be
constrained like “Unless the client is confidential and the
access token issued is key constrained, ... “</div>
<div dir="auto"><br>
</div>
<div dir="auto">Best, </div>
<div dir="auto"><br>
</div>
<div dir="auto">Nat Sakimura<br>
<div dir="auto"><br>
</div>
</div>
<div><br>
<div class="gmail_quote">
<div dir="ltr">2018年11月27日(火) 16:01 Vladimir Dzhuvinov <<a href="mailto:vladimir@connect2id.com" target="_blank">vladimir@connect2id.com</a>>:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">+1 to
recommend the deprecation of implicit.<br>
<br>
I don't see a compelling reason to keep implicit when there
is an<br>
established alternative that is more secure.<br>
<br>
Our duty as WG is to give developers the best and most
sensible practice.<br>
<br>
CORS adoption is currently at 94% according to<br>
<a href="https://caniuse.com/#feat=cors" rel="noreferrer" target="_blank">https://caniuse.com/#feat=cors</a><br>
<br>
Vladimir<br>
<br>
<br>
_______________________________________________<br>
OAuth mailing list<br>
<a href="mailto:OAuth@ietf.org" target="_blank">OAuth@ietf.org</a><br>
<a href="https://www.ietf.org/mailman/listinfo/oauth" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/listinfo/oauth</a><br>
</blockquote>
</div>
</div>
-- <br>
<div dir="ltr" class="m_3198703036183061011gmail_signature" data-smartmail="gmail_signature">Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div>
<br>
<fieldset class="m_3198703036183061011mimeAttachmentHeader"></fieldset>
<pre class="m_3198703036183061011moz-quote-pre">_______________________________________________
OAuth mailing list
<a class="m_3198703036183061011moz-txt-link-abbreviated" href="mailto:OAuth@ietf.org" target="_blank">OAuth@ietf.org</a>
<a class="m_3198703036183061011moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/oauth" target="_blank">https://www.ietf.org/mailman/listinfo/oauth</a>
</pre>
</blockquote>
<pre class="m_3198703036183061011moz-signature" cols="72">--
Jim Manico
Manicode Security
<a class="m_3198703036183061011moz-txt-link-freetext" href="https://www.manicode.com" target="_blank">https://www.manicode.com</a></pre>
</div>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div></div>