I've defined a new response_type for the authorization endpoint for dealing with sessions - call it "urn:example:session_code". Am I required to also include that value in the response as the code identifier, as in (unencoded):
https://client.example.com/cb?urn:example:session_code=SplxlOBeZQQYbYS6WxSbIA &state=xyz I can see arguments either way (returning "code" or "urn:example:session_code" as a response parameter) but I'm not finding guidance in 6749. Also, I'm unsure if questions like this are appropriate for this mailing list's charter, or are best directed to stackoverflow. thanks -- Todd
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
