Why we didn't add a token_delivery parameter
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.
1 post Subscribe via RSS
Engineering write-ups on sign-in, organizations, permissions and the APIs behind them: how they work, and what we learn building them.
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.