StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p><strong><em>For usability and security reasons.</em></strong></p> <p>From the <strong><a href="http://hueniverse.com/2008/10/beginners-guide-to-oauth-part-iii-security-architecture/" rel="nofollow noreferrer">Beginner’s Guide to OAuth</a></strong>:</p> <p><a href="https://hueniverse.com/beginners-guide-to-oauth-part-iii-security-architecture-e9394f5263b5" rel="nofollow noreferrer">https://hueniverse.com/beginners-guide-to-oauth-part-iii-security-architecture-e9394f5263b5</a></p> <blockquote> <p>... While mostly an artifact of how the OAuth specification evolved, <strong>the two-Token design offers some usability and security features</strong> which made it worthwhile to stay in the specification. OAuth operates on two channels: a front-channel which is used to engage the User and request authorization, and a back-channel used by the Consumer to directly interact with the Service Provider. <strong>By limiting the Access Token to the back-channel, the Token itself remains concealed from the User. This allows the Access Token to carry special meanings and to have a larger size than the front-channel Request Token which is exposed to the User when requesting authorization, and in some cases needs to be manually entered (mobile device or set-top box).</strong></p> </blockquote> <p>===</p> <p>Note that this question is a dupe of</p> <p><a href="https://stackoverflow.com/questions/2377541/why-must-we-change-temporary-credentials-for-token-credentials-in-oauth">Why must we "change temporary credentials for token credentials" in OAuth?</a></p> <p>If the explanation from the <em>Beginner’s Guide</em> isn't clear, then go read <a href="https://stackoverflow.com/questions/2377541/why-must-we-change-temporary-credentials-for-token-credentials-in-oauth/2400404#2400404">@npdoty's take on it</a> .</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload