> -----Original Message----- > From: Marius Scurtescu [mailto:[email protected]] > Sent: Monday, April 19, 2010 1:58 PM > To: Eran Hammer-Lahav > Cc: Dick Hardt; OAuth WG > Subject: Re: [OAUTH-WG] Issue: state in web server flow > > On Mon, Apr 19, 2010 at 11:53 AM, Eran Hammer-Lahav > <[email protected]> wrote: > > > > > >> -----Original Message----- > >> From: Marius Scurtescu [mailto:[email protected]] > >> Sent: Monday, April 19, 2010 10:18 AM > > > >> I don't think it is possible to enforce callbacks without any query > parameters. > >> See the Drupal example. > > > > In the Drupal example the client server adds its silly parameters > > internally. > They are not included in what the client provides as its callback URI. > > Silly?
Yes. > The query parameter may or may not be visible in the registered callback. > > > > Can you give an actual callback URI example? > > http://example.com/oauth2/callback > equivalent with: > http://example.com/index.php?q=oauth2/callback Why can't the client always use the first? > > Also, if the client requires query parameters in its callback, it just > > means it > cannot use the client state OAuth parameter. > > Sure it can, perfectly valid to redirect to: > http://example.com/oauth2/callback?code=123&state=qwerty > which is the same as: > http://example.com/index.php?q=oauth2/callback&code=123&state=qwert > y No, I meant according to the last proposal, the state parameter will be limited to cases where there is no query in the callback URI. This makes it easy for servers to validate the pre-registered URI. EHL _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
