Why we didn't add a token_delivery parameter
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.
How Canopy is built: the decisions, the trade-offs and what we learned.
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.