Why is a refresh_token not provided by OAuth2 servers responding to a “client_credentials” grant?

前端 未结 3 1106
醉话见心
醉话见心 2020-12-15 19:32

I\'m reading the OAuth2 spec:

https://tools.ietf.org/html/rfc6749#section-4.4.2

Specially the section on client_credentials grant type.

3条回答
  •  独厮守ぢ
    2020-12-15 19:56

    When applying the Resource Owner Password Credentials grant, it makes sense to return a refresh token so that the client does not need to store or cache the Resource Owner's password - as initially provided by the Resource Owner in an interactive fashion - to get a new access token.

    In the Client Credentials flow, the client's credentials are provided from storage anyway - in an off-line fashion - so the refresh token does not gain any security or usability advantage over just re-using the client credentials again (the client has access to those anyway) to get a new access token.

提交回复
热议问题