{"action":"opened","issue":{"url":"https://api.github.com/repos/ory/fosite/issues/148","repository_url":"https://api.github.com/repos/ory/fosite","labels_url":"https://api.github.com/repos/ory/fosite/issues/148/labels{/name}","comments_url":"https://api.github.com/repos/ory/fosite/issues/148/comments","events_url":"https://api.github.com/repos/ory/fosite/issues/148/events","html_url":"https://github.com/ory/fosite/issues/148","id":212301663,"number":148,"title":"The Implicit Flow should require HTTPS redirection","user":{"login":"itsjamie","id":1956521,"avatar_url":"https://avatars2.githubusercontent.com/u/1956521?v=3","gravatar_id":"","url":"https://api.github.com/users/itsjamie","html_url":"https://github.com/itsjamie","followers_url":"https://api.github.com/users/itsjamie/followers","following_url":"https://api.github.com/users/itsjamie/following{/other_user}","gists_url":"https://api.github.com/users/itsjamie/gists{/gist_id}","starred_url":"https://api.github.com/users/itsjamie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itsjamie/subscriptions","organizations_url":"https://api.github.com/users/itsjamie/orgs","repos_url":"https://api.github.com/users/itsjamie/repos","events_url":"https://api.github.com/users/itsjamie/events{/privacy}","received_events_url":"https://api.github.com/users/itsjamie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-07T01:20:18Z","updated_at":"2017-03-07T01:20:18Z","closed_at":null,"body":"In the code for the implicit flow, it is explicitly mentioned that HTTPS isn't a requirement for the flow because the data can't be leaked in the headers. While this is true, I still feel that TLS should be required because it helps prevent sending the token to a domain the browser doesn't trust.\r\n\r\nWith things like Key pinning, and HSTS, and other techniques, I feel that having the trust and confidentiality via TLS gives some peace of mind that the browser can do a best effort to prevent leaking your token in the fragment..\r\n\r\nThe spec outlines this as part of the Threat Model in RFC6819, where the code links to.\r\nhttps://tools.ietf.org/html/rfc6819#section-4.4.2\r\n```\r\nThreat: Access Token Leak in Transport/Endpoints\r\n   This token might be eavesdropped by an attacker.  The token is sent\r\n   from the server to the client via a URI fragment of the redirect URI.\r\n   If the communication is not secured or the endpoint is not secured,\r\n   the token could be leaked by parsing the returned URI.\r\n\r\n   Impact: The attacker would be able to assume the same rights granted\r\n   by the token.\r\n\r\n   Countermeasures:\r\n   o  The authorization server should ensure confidentiality (e.g.,\r\n      using TLS) of the response from the authorization server to the\r\n      client (see Section 5.1.1).\r\n```\r\n\r\nWhile technically not required, I feel like this should be enforced by default, and (maybe) be relaxed.\r\n\r\nThanks!"}}
{"actor":{"display_login":"itsjamie"}}