When using the OAuth2 resource owner password flow the client ID and secret aren't required. Therefore, what is stopping another 3rd party app from simply asking the user for their username/password combination and using the same flow?
1 Answers
0
votes
IMHO, RFC 6749 (OAuth 2.0) and RFC 6819 (OAuth 2.0 Security) contain slight contradictions about client authentication at token endpoints. My personal conclusion is as follows.
Authorization servers should not require public clients to send their client credentials to token endpoints, but implementations cannot help but require public clients to send their client IDs whatever grant_type is (if the implmentations want to support refresh_token).
If I had to implement the token endpoint for Resource Owner Password Credentials Grant, I would require every client to send its client ID although the specification does not require public clients that have not been issued client secrets to be authenticated at the token endpoint in Resource Owner Password Credentials Grant.
