On Mon, Apr 19, 2010 at 11:53 AM, Eran Hammer-Lahav <[email protected]> wrote: > > >> -----Original Message----- >> From: Marius Scurtescu [mailto:[email protected]] >> Sent: Monday, April 19, 2010 10:18 AM > >> I don't think it is possible to enforce callbacks without any query >> parameters. >> See the Drupal example. > > In the Drupal example the client server adds its silly parameters internally. > They are not included in what the client provides as its callback URI.
Silly? The query parameter may or may not be visible in the registered callback. > Can you give an actual callback URI example? http://example.com/oauth2/callback equivalent with: http://example.com/index.php?q=oauth2/callback > Also, if the client requires query parameters in its callback, it just means > it cannot use the client state OAuth parameter. Sure it can, perfectly valid to redirect to: http://example.com/oauth2/callback?code=123&state=qwerty which is the same as: http://example.com/index.php?q=oauth2/callback&code=123&state=qwerty Justin Richer pointed out that MediaWiki has an identical issue. My guess is that most PHP frameworks will have this problem. Marius _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
