On Tue, Jul 13, 2010 at 1:06 AM, Luke Shepard <[email protected]> wrote:
> I just read this bit: > > If the response type is "code_and_token", the authorization server > adds the "code" and "state" parameters to the redirection URI query > component and the "access_token", "scope", and "expires_in" to the > redirection URI fragment using the > "application/x-www-form-urlencoded" format as defined by > > That strikes me as very odd - returning some params in the query, and > others in the fragment is just weird. > I actually think that you want this – albiet odd – combination when requesting both a code and token. The code and state parameters are needed by the server and thus are query parameters. The access token, scope, and expires in shouldn't be sent to the server via HTTP and thus are within the fragment for the JavaScript to access. I think the request should specify whether it wants the response in the > fragment or query. > You can't always put them into the query because you'd be exposing an access token over HTTP. If you always put them into the fragment then you need to write JavaScript which passes the code and state down to the server.
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
