RFC8252 - OAuth2.0 for Native apps

[yaleman]

RFC8252 - OAuth2.0 for Native apps

[Firstyear]

@0xC0ncord We're going to make this a bool on public clients that allows a localhost redirect as an option, port isn't going to be checked. The reason is that we enforce PKCE which protects the exchange.

[Firstyear]

Given it's redir to localhost, this implies it also has to be a public client does it not? If that's the case, we could make it so public clients have an "allow redirects to localhost" bool where we can special case and check this. Public clients enforce PKCE is required too btw.

[yaleman]

Yep, I think that's the case - but we should require registration of the URL 'cause I don't want arbitrary localhost:* to be allowed

[Firstyear]

The problem is applications may dynamically select the localhost port - this is also what PKCE exists to protect against if the token is sent to the wrong localhost application.

[yaleman]

Bleeeeehhhh those applications need to get in the bin 😄 Have we seen any examples of them yet? Vault and netbird use static ports.

[0xC0ncord]

Have we seen any examples of them yet? Vault and netbird use static ports.

kubelogin's port is configurable (by manually specifying the listen address) but not dynamic.