On Mon, Apr 19, 2010 at 2:24 PM, Eran Hammer-Lahav <[email protected]> wrote: > >> -----Original Message----- >> From: Marius Scurtescu [mailto:[email protected]] >> Sent: Monday, April 19, 2010 1:58 PM >> To: Eran Hammer-Lahav >> Cc: Dick Hardt; OAuth WG >> Subject: Re: [OAUTH-WG] Issue: state in web server flow >> >> On Mon, Apr 19, 2010 at 11:53 AM, Eran Hammer-Lahav >> <[email protected]> wrote: >> > >> > >> >> -----Original Message----- >> >> From: Marius Scurtescu [mailto:[email protected]] >> >> Sent: Monday, April 19, 2010 10:18 AM >> > >> >> I don't think it is possible to enforce callbacks without any query >> parameters. >> >> See the Drupal example. >> > >> > In the Drupal example the client server adds its silly parameters >> > internally. >> They are not included in what the client provides as its callback URI. >> >> Silly? > > Yes. > >> The query parameter may or may not be visible in the registered callback. >> >> >> > Can you give an actual callback URI example? >> >> http://example.com/oauth2/callback >> equivalent with: >> http://example.com/index.php?q=oauth2/callback > > Why can't the client always use the first?
For the PHP code receiving the callback makes absolutely no difference, in both cases it sees the second. The first URL is achieved with Apache doing a rewrite, it acts as a reverse proxy. The backend code is always called with the query parameters. >> > Also, if the client requires query parameters in its callback, it just >> > means it >> cannot use the client state OAuth parameter. >> >> Sure it can, perfectly valid to redirect to: >> http://example.com/oauth2/callback?code=123&state=qwerty >> which is the same as: >> http://example.com/index.php?q=oauth2/callback&code=123&state=qwert >> y > > No, I meant according to the last proposal, the state parameter will be > limited to cases where there is no query in the callback URI. This makes it > easy for servers to validate the pre-registered URI. Servers can validate pre-registered URIs even of the callback has query parameters, including strict matching. Marius _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
