0

I saw in a few places that Imlicit flow clients use iframe to get a new token silently, without user interaction. Why is that? Why can't the client just send a GET request to the authorization server and retrieve the token from the returned HTTP 301 response?

I saw iframe mentioned in these places:

I found this post: OAuth2 Implicit Flow - IFrame Refresh Identity. It says that the request sent from iframe carries a cookie with it. Is it not possible to attach such a cookie from a JS request?

mnj
  • 2,539
  • 3
  • 29
  • 58
  • Btw, isn't it a huge security hole that websites are even allowed to send requests for access tokens to other services (via iframe or not, I'm not sure)? What is stopping some malicious website from sending a request for an access token to my bank silently? I suppose a cookie would be attached (assuming I did login to that bank) and an access token would be returned – mnj Nov 02 '22 at 15:35

0 Answers0