When a user logs into your website with a login form, do you POST their 
password in plaintext over HTTPS ? Most websites do, and the security of the 
"password" grant type is equivalent to that.

If you only allow POST requests to that endpoint, then it should generally keep 
the password out of most generic access logs.

On Sep 6, 2010, at 8:09 PM, Aaron Parecki wrote:

Hi folks,

I'm implementing OAuth 2 for my project (geoloqi.com<http://geoloqi.com/>) 
where I have some mobile phone clients needing to authenticate. I'm using the 
"password" grant type for these clients. Even though the call to the token 
endpoint is going over HTTPS, I'm still slightly concerned about sending the 
user's password to the server unencrypted. (I don't want the users' passwords 
to appear in my debug log file for instance.) Does the spec allow for or have a 
way to extend so that I can define a hashing algorithm the client can use to 
encrypt the password before sending it? I'm already not storing the passwords 
in plain text in the database anyway. Anybody else dealing with a similar issue?

Aaron


_______________________________________________
OAuth mailing list
[email protected]<mailto:[email protected]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to