On Sun, Apr 18, 2010 at 10:36 PM, Dick Hardt <[email protected]> wrote: > > On 2010-04-18, at 10:28 PM, Eran Hammer-Lahav wrote: > >> >> >>> -----Original Message----- >>> From: [email protected] [mailto:[email protected]] On Behalf >>> Of Dick Hardt >>> Sent: Sunday, April 18, 2010 9:20 PM >>> To: OAuth WG >>> Subject: [OAUTH-WG] Issue: state in web server flow >>> >>> Why was the state parameter removed from the web server flow? >> >> I didn't want to both define a state parameter *and* allow for any other >> client-specific parameters in redirection URIs. Because people made the >> point that *any* client-specific parameters are required, I proposed to drop >> the state parameter. After all, servers MUST send back whatever URI they >> receive regardless of it being encoded into a state parameter. >> >>> Some AS may require the entire redirect URI to be registered, so the state >>> parameter allows a client to maintain state across calls. >> >> I agree that this is useful, but it only makes the spec better if we make >> its use more restrictive. Defining it makes it easier for servers to >> validate the redirection URI, but only if the client is not allowed using >> other client-specific query parameters with it. > > Agreed > >> >> If people feel strongly about putting it back, I suggest we only allow it >> with callbacks without any query component as that is the only combination >> it adds value. > > Agreed
I don't think it is possible to enforce callbacks without any query parameters. See the Drupal example. What we can enforce is that the registered callback and the actual callback have the exact same query parameters. Marius _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
