> If the response type is code-and-token, the authorization server adds the > codeand state parameters to the redirection URI query component and the > access_token, scope, and expires_in to the redirection URI fragment using > theapplication/x-www-form-urlencoded format as defined by...
Since the scope applies equally to both the code and access_token parameters, it seems that scope should be included in the URI query part so it is available to the web server as well as the user-agent. While the scope remains in the fragment, the client's web server won't know whether the full scope it requested was actually granted. Was there an advantage to including the scope only in the #fragment, or was this just an oversight? Thanks. -- Andrew Arnott "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
