On 2010-04-18, at 10:28 PM, Eran Hammer-Lahav wrote:

> 
> 
>> -----Original Message-----
>> From: [email protected] [mailto:[email protected]] On Behalf
>> Of Dick Hardt
>> Sent: Sunday, April 18, 2010 9:20 PM
>> To: OAuth WG
>> Subject: [OAUTH-WG] Issue: state in web server flow
>> 
>> Why was the state parameter removed from the web server flow?
> 
> I didn't want to both define a state parameter *and* allow for any other 
> client-specific parameters in redirection URIs. Because people made the point 
> that *any* client-specific parameters are required, I proposed to drop the 
> state parameter. After all, servers MUST send back whatever URI they receive 
> regardless of it being encoded into a state parameter.
> 
>> Some AS may require the entire redirect URI to be registered, so the state
>> parameter allows a client to maintain state across calls.
> 
> I agree that this is useful, but it only makes the spec better if we make its 
> use more restrictive. Defining it makes it easier for servers to validate the 
> redirection URI, but only if the client is not allowed using other 
> client-specific query parameters with it.

Agreed

> 
> If people feel strongly about putting it back, I suggest we only allow it 
> with callbacks without any query component as that is the only combination it 
> adds value.

Agreed

_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to