diff --git a/docs/docs/faq.md b/docs/docs/faq.md index a7c14f4ab3a..6f7d77809ba 100644 --- a/docs/docs/faq.md +++ b/docs/docs/faq.md @@ -46,7 +46,7 @@ The following is a copy of the original [comment on GitHub](https://github.com/ory/hydra/pull/297#issuecomment-294282671): I took a long time for this issue, primarily because I felt very uncomfortable -implementing it. The ROCP grant is something from the "dark ages" of OAuth2 and +implementing it. The ROPC grant is something from the "dark ages" of OAuth2 and there are suitable replacements for mobile clients, such as public oauth2 clients, which are supported by Hydra: https://tools.ietf.org/html/draft-ietf-oauth-native-apps-09 diff --git a/docs/docs/limitations.md b/docs/docs/limitations.md index 014a60d6297..1c23cef6858 100644 --- a/docs/docs/limitations.md +++ b/docs/docs/limitations.md @@ -35,7 +35,7 @@ For more information on this topic we recommend reading: - https://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length - https://security.stackexchange.com/questions/6623/pre-hash-password-before-applying-bcrypt-to-avoid-restricting-password-length -## Resource Owner Password Credentials Grant Type (ROCP) +## Resource Owner Password Credentials Grant Type (ROPC) ORY Hydra does not and will not implement the Resource Owner Password Credentials Grant Type. Read on for context. @@ -80,7 +80,7 @@ first-party apps. If you plan on doing this, stop right now and read ### Legacy & Bad Security -The ROCP grant type is discouraged by developers, professionals, and the IETF +The ROPC grant type is discouraged by developers, professionals, and the IETF itself. It was originally added because big legacy corporations (not dropping any names, but they are part of the IETF consortium) did not want to migrate their authentication infrastructure to the modern web but instead do what