On Tue, Jul 13, 2010 at 9:42 AM, David Recordon <[email protected]> wrote: >> That strikes me as very odd - returning some params in the query, and >> others in the fragment is just weird. > > I actually think that you want this – albiet odd – combination when > requesting both a code and token. The code and state parameters are needed > by the server and thus are query parameters. The access token, scope, and > expires in shouldn't be sent to the server via HTTP and thus are within > the fragment for the JavaScript to access.
The problem is that if you do it this way you end up busting the browser cache. All of the performance improvements offered by the user-agent profile are lost. Cheers, Brian _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
