4

I recently checked the post on Digging Deeper into OAuth 2.0 on Force.com by Pat Patterson.

Question

In client User-Agent authentication flow, the token is sent in the redirect URI only. Now I don't understood, how its secure ? If it is then why we used HTTP POST to get access token in web server authentication flow.

I am relatively new at this, so I don't understood how the fragment URL (only difference) can secure the token?

|improve this question
  • we will have metadady answer this for you soon :) – Mohith Shrivastava Dec 4 '13 at 8:16
  • @MohithKumar Indeed, that will be great as he wrote the article. – Rajendra Singh Nagar Dec 6 '13 at 5:18
3

The web server and the user agent flows are intended for different usage scenarios, and the security of each is in the fact that the authentication always happens between the user and salesforce directly. The third-party application that accesses the user's data on salesforce is never allowed to see the user's credentials.

The trick with the user agent flow is that the token is sent not as a get parameter, which would be stored in browser history, but as a fragment which does not get stored in history.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.