Web Security · Senior · Question 47 of 75

Why does the OAuth BCP discourage the resource owner password credentials grant?

1Because it only works with GitHub
2Because it's slower than other flows
✓Correct answer: The client sees the user's password, which breaks the whole point of delegated authorization and blocks MFA and passkeys

Explanation

Users get trained to type passwords into third-party apps, and modern authentication steps can't be added.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.