Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

area51 chapters texts in as they are #2521

Merged
merged 7 commits into from
Jan 16, 2025

Conversation

elarlang
Copy link
Collaborator

Chapter texts for V51 OAuth and OIDC

Copy link
Contributor

@TobiasAhnoff TobiasAhnoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many suggestions on minor changes to correct some spelling, hopefully some clearer wording and well-aligned with RFCs etc.

5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
5.0/en/0x51-V51-OAuth2.md Outdated Show resolved Hide resolved
@elarlang
Copy link
Collaborator Author

Hi @TobiasAhnoff and @randomstuff - I made some updates to the PR, but it is not covering every comment here.

If you have agreement, please update the PR as well - it is more effective way than I going to do the find-replace activity.

If there is a separate discussion (especially about some requirement wording), please open a separate issue for that.

The goal here is to have the chapter text in and to get wider feedback for this.

@jmanico
Copy link
Member

jmanico commented Jan 13, 2025 via email

@TobiasAhnoff
Copy link
Contributor

A public client is not capable of maintaining the confidentiality of credentials or is able to authenticate itself with the authorization server in a secure way. Therefore, a public client can not be trusted with client credentials and can only identify itself using the given client id.
That said, this configuration should still provide zero access until the user authenticates and grants consent. Also, security measures like PKCE is required….

Yes, I think we have this covered in requirements for PKCE and consent etc

@elarlang elarlang marked this pull request as ready for review January 14, 2025 16:25
@elarlang
Copy link
Collaborator Author

The action from here is - @tghosth checks the language/grammar and we merge it in.

It does not mean that it is completely ready now and can not have changes in the future - it only means it gets into the document to get feedback from a wider audience and new modifications go in through separate PRs.

@tghosth
Copy link
Collaborator

tghosth commented Jan 16, 2025

@elarlang you can merge this if you are comfortable with the final changes I made: c693ffb

@elarlang elarlang merged commit cc4e756 into OWASP:master Jan 16, 2025
6 checks passed
@elarlang elarlang deleted the asvs-area51-chapter-texts branch January 16, 2025 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants