Study. uk . com
  1. Home
  2. All questions
  3. Question 352

CISSP study material · question 352 of 500

A single-page application running entirely in the browser is being registered with an authorization server. Which OAuth client type is it, and why?

  1. Confidential, because the code is served from a controlled origin.
  2. Neither: browser-based applications are outside the framework's client model.
  3. Public, because it cannot keep its credentials confidential.
  4. Confidential, because the browser isolates its storage from other origins.
Show the answer

Answer: C. Public, because it cannot keep its credentials confidential.

OAuth defines public clients as those incapable of maintaining the confidentiality of their credentials, giving native applications and browser-based applications as examples.

Source: RFC 6749 (IETF) — RFC 6749 > 2.1 Client Types

Challenge yourself on this topic → Study as cards