Hear hear!

I've been following OAuth 2.1 for a couple of years. Can't wait for it to get released. If you want to check out the IETF draft, here is the current version: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...

Reading the "Differences from OAuth 2.0" section is helpful for understanding what changes are coming: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...

You can also give your feedback on this or any other draft on the IETF OAuth mailing list: https://www.ietf.org/mailman/listinfo/oauth

I've been lurking there for a long time and learned a lot; you can view the archives here: https://mailarchive.ietf.org/arch/browse/oauth/

Hard to believe this isn't common practice at this point. Way back when I was just getting started in my career I implemented an OAuth 2.0 server and it was already accepted that auth code grants were the only reasonable way to do things. Here's what I wrote in the docs for that project:

    The decisions that are most important to the security of your application are:
    
    - The authorization endpoint will only return authorization codes, which can later be exchanged for access tokens.

    - Password credentials grants, implicit grants, client credentials grants, and all extension grants are not supported.

    - Public clients are not supported.

    - Every client is required to register its redirect_uri.

    - All authorization, token, and API requests are required to use TLS encryption in order to prevent credentials from being leaked to a third-party. In addition, the registered redirect_uri must also be secured with TLS.

    - Clients are required to CSRF-protect their redirection endpoints.

https://djoauth2.readthedocs.io/en/latest/overview.html#what...

OIDC+OAuth is what most people actually want when they think of OAuth imo. The main issue here is that OAuth was not designed as an authentication protocol.

Aren't the exploits here in not checking that the access token calling you was for you? That is, it wasn't the implicit grant, it was not checking the audience/signature of the token?

What makes this an implicit grant problems?