{"action":"created","issue":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/530","labels_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/530/labels{/name}","comments_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/530/comments","events_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/530/events","html_url":"https://github.com/simplabs/ember-simple-auth/issues/530","id":79054222,"number":530,"title":"How secure is the OAuth authenticator?","user":{"login":"Fryie","id":1214238,"avatar_url":"https://avatars.githubusercontent.com/u/1214238?v=3","gravatar_id":"","url":"https://api.github.com/users/Fryie","html_url":"https://github.com/Fryie","followers_url":"https://api.github.com/users/Fryie/followers","following_url":"https://api.github.com/users/Fryie/following{/other_user}","gists_url":"https://api.github.com/users/Fryie/gists{/gist_id}","starred_url":"https://api.github.com/users/Fryie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fryie/subscriptions","organizations_url":"https://api.github.com/users/Fryie/orgs","repos_url":"https://api.github.com/users/Fryie/repos","events_url":"https://api.github.com/users/Fryie/events{/privacy}","received_events_url":"https://api.github.com/users/Fryie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-21T15:51:57Z","updated_at":"2015-05-21T16:23:22Z","closed_at":null,"body":"Apologies for not asking this on Stack Overflow, but I fear that it will be closed as \"too opinion-based\".\r\n\r\nI see that the OAuth authenticator is using the Resource Owner Password-Based Grant flow, which to my opinion made sense to me when reading about OAuth. However, I've come across [this blog post](http://alexbilbie.com/2014/11/oauth-and-javascript/) about this being insecure.\r\nHaving no extensive experience with web security, I can recognize the arguments made, but I'm not in a position to judge how real the threats are and whether there are other measures that can be taken to mitigate the risks. The solution proposed in the blog, to use a server-side proxy, would probably entail a lot of work and hand-rolling a custom solution.\r\n\r\nSo my question is whether there are either more resources (about SPAs and OAuth in particular) or some particular opinions as to how secure the OAuth authenticator really is, what special measures might have to be taken, etc. For me personally, the risks identified in the article don't seem to be such a big deal provided that SSL is used consistently, but I might be missing something.\r\n\r\nI realise this is not a real \"issue\", but I found it quite hard to find good information on this topic. "},"comment":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/comments/104342868","html_url":"https://github.com/simplabs/ember-simple-auth/issues/530#issuecomment-104342868","issue_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/530","id":104342868,"user":{"login":"marcoow","id":1510,"avatar_url":"https://avatars.githubusercontent.com/u/1510?v=3","gravatar_id":"","url":"https://api.github.com/users/marcoow","html_url":"https://github.com/marcoow","followers_url":"https://api.github.com/users/marcoow/followers","following_url":"https://api.github.com/users/marcoow/following{/other_user}","gists_url":"https://api.github.com/users/marcoow/gists{/gist_id}","starred_url":"https://api.github.com/users/marcoow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcoow/subscriptions","organizations_url":"https://api.github.com/users/marcoow/orgs","repos_url":"https://api.github.com/users/marcoow/repos","events_url":"https://api.github.com/users/marcoow/events{/privacy}","received_events_url":"https://api.github.com/users/marcoow/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T16:23:22Z","updated_at":"2015-05-21T16:23:22Z","body":"Yes, the API basically allows requests from anyone as the identity of the client couldn't be verified anyway."}}