On Sun, Jul 11, 2010 at 1:22 PM, Eran Hammer-Lahav <[email protected]> wrote: > This is a naïve questions: > > Why not just say the server MUST match the redirection URI if one was > previously registered, and require registration for user-agent clients?
I don't know enough to be sure that's the right answer. As far as I can tell, the industry isn't converging on a solution, so I'm reluctant to say MUST to anything. I suspect the FB folks have the most experience with this kind of profile. _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
