4 ms·
I think this is even covered in the spec. The authorization server MUST require the following clients to register their redirection endpoint: o Publi
by tveita 13y ago
I think this is even covered in the spec.
The authorization server MUST require the following clients to
register their redirection endpoint:
o Public clients.
o Confidential clients utilizing the implicit grant type.
The authorization server SHOULD require all clients to register their
redirection endpoint prior to utilizing the authorization endpoint.
http://tools.ietf.org/html/rfc6749#section-3.1.2.2 http://tools.ietf.org/html/rfc6749#section-3.1.2.2
- kodablah 13y agoThe OAuth servers I have developed have done like GitHub does [1] and at least confirm the redirect given during auth starts with the application-level URI. I think it gives plenty of flexibility while still not openly redirecting. Edit: Or maybe I don't understand the flaw since it says GitHub is vulnerable... 1 - https://developer.github.com/v3/oauth/#redirect-urls https://developer.github.com/v3/oauth/#redirect-urls
- cratermoon 13y agoGood Oauth2.0 and later implementations enforce this. Note that Twitter does not fall into that category.