Skip to content

Commit 3818f86

Browse files
ralfhandlralfhandl
committed
Discourage use of implicit grant
See OAI/OpenAPI-Specification#3584
1 parent d278339 commit 3818f86

File tree

3 files changed

+21
-19
lines changed

3 files changed

+21
-19
lines changed

‎vocabularies/Org.OData.Authorization.V1.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@
113113
"OAuth2Implicit": {
114114
"$Kind": "ComplexType",
115115
"$BaseType": "Authorization.OAuthAuthorization",
116+
"@Core.Description": "Security note: OAuth2 implicit grant is considered to be not secure and should not be used by clients, see [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics.html#name-implicit-grant).",
116117
"AuthorizationUrl": {
117118
"@Core.Description": "Authorization URL",
118119
"@Core.IsURL": true

‎vocabularies/Org.OData.Authorization.V1.md

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -91,18 +91,18 @@ Property|Type|Description
9191

9292
<a name="OAuth2Implicit"></a>
9393
## [OAuth2Implicit](./Org.OData.Authorization.V1.xml#L125:~:text=<ComplexType%20Name="-,OAuth2Implicit,-"): [OAuthAuthorization](#OAuthAuthorization)
94-
94+
Security note: OAuth2 implicit grant is considered to be not secure and should not be used by clients, see [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics.html#name-implicit-grant).
9595

9696
Property|Type|Description
9797
:-------|:---|:----------
9898
[*Name*](./Org.OData.Authorization.V1.xml#L84:~:text=<ComplexType%20Name="-,Authorization,-")|String|Name that can be used to reference the authorization scheme
9999
[*Description*](./Org.OData.Authorization.V1.xml#L87:~:text=<ComplexType%20Name="-,Authorization,-")|String?|Description of the authorization scheme
100100
[*Scopes*](./Org.OData.Authorization.V1.xml#L109:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|\[[AuthorizationScope](#AuthorizationScope)\]|Available scopes
101101
[*RefreshUrl*](./Org.OData.Authorization.V1.xml#L112:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|URL?|Refresh Url
102-
[AuthorizationUrl](./Org.OData.Authorization.V1.xml#L126:~:text=<ComplexType%20Name="-,OAuth2Implicit,-")|URL|Authorization URL
102+
[AuthorizationUrl](./Org.OData.Authorization.V1.xml#L127:~:text=<ComplexType%20Name="-,OAuth2Implicit,-")|URL|Authorization URL
103103

104104
<a name="OAuth2Password"></a>
105-
## [OAuth2Password](./Org.OData.Authorization.V1.xml#L132:~:text=<ComplexType%20Name="-,OAuth2Password,-"): [OAuthAuthorization](#OAuthAuthorization)
105+
## [OAuth2Password](./Org.OData.Authorization.V1.xml#L133:~:text=<ComplexType%20Name="-,OAuth2Password,-"): [OAuthAuthorization](#OAuthAuthorization)
106106

107107

108108
Property|Type|Description
@@ -111,10 +111,10 @@ Property|Type|Description
111111
[*Description*](./Org.OData.Authorization.V1.xml#L87:~:text=<ComplexType%20Name="-,Authorization,-")|String?|Description of the authorization scheme
112112
[*Scopes*](./Org.OData.Authorization.V1.xml#L109:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|\[[AuthorizationScope](#AuthorizationScope)\]|Available scopes
113113
[*RefreshUrl*](./Org.OData.Authorization.V1.xml#L112:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|URL?|Refresh Url
114-
[TokenUrl](./Org.OData.Authorization.V1.xml#L133:~:text=<ComplexType%20Name="-,OAuth2Password,-")|URL|Token Url
114+
[TokenUrl](./Org.OData.Authorization.V1.xml#L134:~:text=<ComplexType%20Name="-,OAuth2Password,-")|URL|Token Url
115115

116116
<a name="OAuth2AuthCode"></a>
117-
## [OAuth2AuthCode](./Org.OData.Authorization.V1.xml#L139:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-"): [OAuthAuthorization](#OAuthAuthorization)
117+
## [OAuth2AuthCode](./Org.OData.Authorization.V1.xml#L140:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-"): [OAuthAuthorization](#OAuthAuthorization)
118118

119119

120120
Property|Type|Description
@@ -123,42 +123,42 @@ Property|Type|Description
123123
[*Description*](./Org.OData.Authorization.V1.xml#L87:~:text=<ComplexType%20Name="-,Authorization,-")|String?|Description of the authorization scheme
124124
[*Scopes*](./Org.OData.Authorization.V1.xml#L109:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|\[[AuthorizationScope](#AuthorizationScope)\]|Available scopes
125125
[*RefreshUrl*](./Org.OData.Authorization.V1.xml#L112:~:text=<ComplexType%20Name="-,OAuthAuthorization,-")|URL?|Refresh Url
126-
[AuthorizationUrl](./Org.OData.Authorization.V1.xml#L140:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-")|URL|Authorization URL
127-
[TokenUrl](./Org.OData.Authorization.V1.xml#L144:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-")|URL|Token Url
126+
[AuthorizationUrl](./Org.OData.Authorization.V1.xml#L141:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-")|URL|Authorization URL
127+
[TokenUrl](./Org.OData.Authorization.V1.xml#L145:~:text=<ComplexType%20Name="-,OAuth2AuthCode,-")|URL|Token Url
128128

129129
<a name="AuthorizationScope"></a>
130-
## [AuthorizationScope](./Org.OData.Authorization.V1.xml#L150:~:text=<ComplexType%20Name="-,AuthorizationScope,-")
130+
## [AuthorizationScope](./Org.OData.Authorization.V1.xml#L151:~:text=<ComplexType%20Name="-,AuthorizationScope,-")
131131

132132

133133
Property|Type|Description
134134
:-------|:---|:----------
135-
[Scope](./Org.OData.Authorization.V1.xml#L151:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String|Scope name
136-
[Grant](./Org.OData.Authorization.V1.xml#L154:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String?|Identity that has access to the scope or can grant access to the scope.
137-
[Description](./Org.OData.Authorization.V1.xml#L158:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String|Description of the scope
135+
[Scope](./Org.OData.Authorization.V1.xml#L152:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String|Scope name
136+
[Grant](./Org.OData.Authorization.V1.xml#L155:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String?|Identity that has access to the scope or can grant access to the scope.
137+
[Description](./Org.OData.Authorization.V1.xml#L159:~:text=<ComplexType%20Name="-,AuthorizationScope,-")|String|Description of the scope
138138

139139
<a name="ApiKey"></a>
140-
## [ApiKey](./Org.OData.Authorization.V1.xml#L163:~:text=<ComplexType%20Name="-,ApiKey,-"): [Authorization](#Authorization)
140+
## [ApiKey](./Org.OData.Authorization.V1.xml#L164:~:text=<ComplexType%20Name="-,ApiKey,-"): [Authorization](#Authorization)
141141

142142

143143
Property|Type|Description
144144
:-------|:---|:----------
145145
[*Name*](./Org.OData.Authorization.V1.xml#L84:~:text=<ComplexType%20Name="-,Authorization,-")|String|Name that can be used to reference the authorization scheme
146146
[*Description*](./Org.OData.Authorization.V1.xml#L87:~:text=<ComplexType%20Name="-,Authorization,-")|String?|Description of the authorization scheme
147-
[KeyName](./Org.OData.Authorization.V1.xml#L164:~:text=<ComplexType%20Name="-,ApiKey,-")|String|The name of the header or query parameter
148-
[Location](./Org.OData.Authorization.V1.xml#L167:~:text=<ComplexType%20Name="-,ApiKey,-")|[KeyLocation](#KeyLocation)|Whether the API Key is passed in the header or as a query option
147+
[KeyName](./Org.OData.Authorization.V1.xml#L165:~:text=<ComplexType%20Name="-,ApiKey,-")|String|The name of the header or query parameter
148+
[Location](./Org.OData.Authorization.V1.xml#L168:~:text=<ComplexType%20Name="-,ApiKey,-")|[KeyLocation](#KeyLocation)|Whether the API Key is passed in the header or as a query option
149149

150150
<a name="KeyLocation"></a>
151-
## [KeyLocation](./Org.OData.Authorization.V1.xml#L172:~:text=<EnumType%20Name="-,KeyLocation,-")
151+
## [KeyLocation](./Org.OData.Authorization.V1.xml#L173:~:text=<EnumType%20Name="-,KeyLocation,-")
152152

153153

154154
Member|Value|Description
155155
:-----|----:|:----------
156-
[Header](./Org.OData.Authorization.V1.xml#L173:~:text=<EnumType%20Name="-,KeyLocation,-")|0|API Key is passed in the header
157-
[QueryOption](./Org.OData.Authorization.V1.xml#L176:~:text=<EnumType%20Name="-,KeyLocation,-")|1|API Key is passed as a query option
158-
[Cookie](./Org.OData.Authorization.V1.xml#L179:~:text=<EnumType%20Name="-,KeyLocation,-")|2|API Key is passed as a cookie
156+
[Header](./Org.OData.Authorization.V1.xml#L174:~:text=<EnumType%20Name="-,KeyLocation,-")|0|API Key is passed in the header
157+
[QueryOption](./Org.OData.Authorization.V1.xml#L177:~:text=<EnumType%20Name="-,KeyLocation,-")|1|API Key is passed as a query option
158+
[Cookie](./Org.OData.Authorization.V1.xml#L180:~:text=<EnumType%20Name="-,KeyLocation,-")|2|API Key is passed as a cookie
159159

160160
<a name="SchemeName"></a>
161-
## [SchemeName](./Org.OData.Authorization.V1.xml#L184:~:text=<TypeDefinition%20Name="-,SchemeName,-")
161+
## [SchemeName](./Org.OData.Authorization.V1.xml#L185:~:text=<TypeDefinition%20Name="-,SchemeName,-")
162162
**Type:** String
163163

164164
The name of the authorization scheme.

‎vocabularies/Org.OData.Authorization.V1.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@
123123
</ComplexType>
124124

125125
<ComplexType Name="OAuth2Implicit" BaseType="Authorization.OAuthAuthorization">
126+
<Annotation Term="Core.Description" String="Security note: OAuth2 implicit grant is considered to be not secure and should not be used by clients, see [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics.html#name-implicit-grant)." />
126127
<Property Name="AuthorizationUrl" Type="Edm.String" Nullable="false">
127128
<Annotation Term="Core.Description" String="Authorization URL" />
128129
<Annotation Term="Core.IsURL" />

0 commit comments

Comments
 (0)