Skip to content

Commit 72f9043

Browse files
authored
oAuth -> OAuth (#17560)
1 parent 904a685 commit 72f9043

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

  • aspnetcore/security/blazor/webassembly

aspnetcore/security/blazor/webassembly/index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ For more information, see <xref:security/authentication/social/additional-claims
134134

135135
### Authenticate users to only call protected third party APIs
136136

137-
Authenticate the user with a client-side oAuth flow against the third-party API provider:
137+
Authenticate the user with a client-side OAuth flow against the third-party API provider:
138138

139139
```csharp
140140
builder.services.AddOidcAuthentication(options => { ... });
@@ -156,7 +156,7 @@ When a user logs in, Identity collects access and refresh tokens as part of the
156156

157157
Use the access token generated on the server to retrieve the third-party access token from a server API endpoint. From there, use the third-party access token to call third-party API resources directly from Identity on the client.
158158

159-
We don't recommend this approach. This approach requires treating the third-party access token as if it were generated for a public client. In oAuth terms, the public app doesn't have a client secret because it can't be trusted to store secrets safely, and the access token is produced for a confidential client. A confidential client is a client that has a client secret and is assumed to be able to safely store secrets.
159+
We don't recommend this approach. This approach requires treating the third-party access token as if it were generated for a public client. In OAuth terms, the public app doesn't have a client secret because it can't be trusted to store secrets safely, and the access token is produced for a confidential client. A confidential client is a client that has a client secret and is assumed to be able to safely store secrets.
160160

161161
* The third-party access token might be granted additional scopes to perform sensitive operations based on the fact that the third-party emitted the token for a more trusted client.
162162
* Similarly, refresh tokens shouldn't be issued to a client that isn't trusted, as doing so gives the client unlimited access unless other restrictions are put into place.

0 commit comments

Comments
 (0)