'What's the motivation for an access token debug step in OAuth2?
The following figure is from the paper by Yang et al. (https://paper.bobylive.com/Meeting_Papers/BlackHat/Europe-2016/eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20-wp.pdf)
What I wonder is the motivation for step 6 ("AT Debug"). It confuses me because the access token (AT) was just received in the previous step (Step 5), so why send it back to the IdP again right after that?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|