Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I recently checked the post on Digging Deeper into OAuth 2.0 on Force.com by Pat Patterson.
Question
In client User-Agent authentication flow, the token is sent in the redirect URI only. Now I don't understood, how its secure ? If it is then why we used HTTP POST to get access token in web server authentication flow.
I am relatively new at this, so I don't understood how the fragment URL (only difference) can secure the token?
The web server and the user agent flows are intended for different usage scenarios, and the security of each is in the fact that the authentication always happens between the user and salesforce directly. The third-party application that accesses the user's data on salesforce is never allowed to see the user's credentials.
The trick with the user agent flow is that the token is sent not as a get parameter, which would be stored in browser history, but as a fragment which does not get stored in history.
