Authentication and Authorization experiences, designs and demos

[marcoow]

@domchristie

From this, I gather that, when refreshing an access token, authentication is required (the spec uses HTTP Basic auth in the example), and that there has to be some way of identifying that the refresh token was issued to the client. It’s on these points where I don’t believe that Ember Simple Auth conforms—it simply sends up the refresh token as a request param, along with the soon-to-expire access token.

I’m the main author of Ember.SimpleAuth so a quick note from my side: client id/client secret are now supported (see this pull request). HTTP Auth is not supported but if anyone would like to send a pull request I’d be ok with adding it. The main point here is that both client id/client secret as well as HTTP auth don’t really provide additional security. If an attacker can get access to your refresh token they can most likely get access to the client id/client secret or basic auth or whatever as well. The problem is that all this security-relevant stuff needs to be on the client (as it’s used by Ember) and thus can be exposed by an attacker if you a) don’t use (correctly configured) SSL or b) are vulnerable to XSS attacks.