Adds support for confidential clients / clients which have been issued client credentials

[jrhe]

Adds support for confidential clients / clients which have been issued client credentials as per rfc6749#section-3.2.1 http://tools.ietf.org/html/rfc6749#section-3.2.1

[marcoow]

Just curious what the use case would be for client_id/client_secret. There's not much added security when you use it in a JS app that you deploy to the internet (and thus the secret is revealed to everybody) right?

[jrhe]

You are correct in your thinking but this serves a few purposes as disclosed in §3.2.1 of the spec:
o Enforcing the binding of refresh tokens and authorization codes to
the client they were issued to. Client authentication is critical
when an authorization code is transmitted to the redirection
endpoint over an insecure channel or when the redirection URI has
not been registered in full.

o Recovering from a compromised client by disabling the client or
changing its credentials, thus preventing an attacker from abusing
stolen refresh tokens. Changing a single set of client
credentials is significantly faster than revoking an entire set of
refresh tokens.

o Implementing authentication management best practices, which
require periodic credential rotation. Rotation of an entire set
of refresh tokens can be challenging, while rotation of a single
set of client credentials is significantly easier.

So if I set up my API so it didn't require client credentials and someone started hammering my API, I'd have no way of cutting them of except basically turning off the API. With client credentials I can basically revoke and reissue just the one set and keep all other apps which use the api running. Its also good for identification purposes, fine someone could steal them and abuse them but other than malicious traffic I know what app a request is coming from.

Additionally some OAuth libraries require it. In particular Doorkeepers latest release. This seems to be fixed on head.

[marcoow]

Be aware that this is going to change slightly when I release the big refactoring that introduces strategies (see #20). The functionality is going to stay, it will just be moved into a strategy.