9 lines
660 B
Text
9 lines
660 B
Text
|
|
=== Compromised Authorization Code
|
|
|
|
For the <<_oidc-auth-flows, OIDC Auth Code Flow>>, it would be very hard for an attacker to compromise {project_name} authorization codes.
|
|
{project_name} generates a cryptographically strong random value for its authorization codes so it would be very hard to guess an access token.
|
|
An authorization code can only be used once to obtain an access token.
|
|
In the admin console you can specify how long an authorization code is valid for on the <<_timeouts, timeouts page>>.
|
|
This value should be really short, as short as a few seconds and just long enough for the client to make the request to obtain a token from the code.
|
|
|