Basic - 6.1 Assertion Manufacture/Modification : In implicit flow, assetion may be sent over non-TLS channel

[Nat Sakimura]

The spec requires the server endpoints to be TLS, but not the Clients. In implicit flow, the Assertion may be sent first to the browser, then to the non-TLS Client. Thus, the sentence is wrong.

For non-TLS Web Server Client, one MUST use code flow to mitigate this attack. For Web Browser Client which was loaded from a non-TLS origin, one SHOULD use implicit flow to avoid passing access_token over a clear channel.

[John Bradley]

Sec 3 was changed to state that clients MUST use TLS for this flow. Non TLS clients must use the code flow

[John Bradley]

fixes #98 added xref to standard for code flow

→ 9de9637cb4d4