Dynamic Configuration of redirect_uri about oauth2-server

[alexbilbie]

What is dynamic about the redirect uri you are using? Can the dynamic bit instead be put in the state parameter?

Emailing from my iPhone like a BOSS

On 13 Jun 2013, at 02:48, David Mosher [email protected] wrote:

Per the OAuth 2.0 spec section 3.2.1.3 on page 13 (emphasis added):

When a redirection URI is included in an authorization request, the authorization server
MUST compare and match the value received against at least one of the registered
redirection URIs (or URI components) as defined in section 6...

The way the storage currently works is that it is checking for an exact match of the redirect_uri. This fails when say your provider is attempting to append a query string to the redirect_uri.

I'm currently working on a fix for this internally for myself...but wanted to make sure I'm seeing this correctly and am not just overlooking something. Thoughts?

—
Reply to this email directly or view it on GitHub.

[arenowebdev]

I'm not too much in control of what I'm receiving, but I completely understand what you're saying there. What it appears to be from with who I'm working with, they need info in the query string of the redirect uri. I have a fix in place, and I'm more than willing to share if it's something you'd be interested in... Let me know. For now, I will go ahead and close this though. :D