Database.com Chatter REST API Developer's Guide - Salesforce.com

Introducing Chatter REST API
Understanding the User-Agent OAuth Authentication Flow
Parameters
issued_at
Description
and issued_at. This can be used to verify the identity
URL was not modified since it was sent by the server.
When the signature was created.
Understanding the User-Agent OAuth Authentication Flow
Typically this flow is used by mobile apps or applications that directly access the Chatter API from JavaScript. In this flow,
it is assumed that the client application can’t be trusted to store client credentials, nor the user login credentials.
Warning: Because the access token is encoded into the redirection URI, it might be exposed to the end-user and
other applications residing on the computer or device.
If you are authenticating using JavaScript, we recommend calling window.location.replace(); to remove the
callback from the browser’s history.
The following is the general flow. The individual step descriptions follow.
The following is a general description of the OAuth user-agent flow:
19