Proposal to protect the "OAuth2 AuthCode Grant authorisation request" endpoint #71
Description
Problem description
Referring to the following sequence diagram,
is the endpoint "OAuth2 AuthCode Grant authorisation request (prompt=none&redirect_uri)" on the AuthServer protected?
Possible evolution
Proposal to have a one-time use token to prevent abuse of this un-protected endpoint on AuthServer.
The App Backend will need to obtain this one-time use token from the AuthServer and pass it to the Device App.
Proposal as attached:
