> This is worrisome because open-redirects would not otherwise be considered much of a security problem yeah, indeed. It becomes a problem for OAuth only. And,

> This is worrisome because open-redirects would not otherwise be considered much of a security problem yeah, indeed. It becomes a problem for OAuth only. And, wait, Facebook is pwned, so it's he who MUST worry, not clients Spec is very long and has many interesting discussions but have a look at real world. neither facebook nor twitter whitelist redirect_uri