This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749

In Section 2.3, there is this line

The client MUST NOT use more than one authentication method in each request.

What exactly does this mean?


It's an error for the user to attempt to authenticate twice, e.g. via HTTP Basic Auth and then via Post. I believe that this is to avoid specifying what should be done if the user sends two different client_ids via two different authentication methods - rather than specifying which authentication takes precedence, it's simpler to forbid this scenario altogether

  • What if the client_ids are same via the 2 authentication methods? i.e. there is 2 Factor authentication - i.e password and then an OTP? – user93353 Jun 1 '15 at 23:43
  • @user93353 The server for which OAuth is a delegate may employ 2 factor authentication when issuing the token, but that's outside of OAuth's purview – Zim-Zam O'Pootertoot Jun 2 '15 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.