Subject: [OAUTH-WG] section 3.2 error in draft-ietf-oauth-v2-10

From: "Nick Walker" <[email-masked]>
Date: Tue, 16 Nov 2010 15:45:14 -0800

In section 3.2 of draft-ietf-oauth-v2-10:

    "... if the request is invalid, the authorization server informs
    the client by adding the following parameters to the redirection
    URI query component ..."

This leads to issuing an HTTP 302 response with an invalid Location
header if the redirect_uri parameter is missing or invalid.

I believe the correct behavior in this case is the same as in section 4.3.

Nick

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 30 Nov 2010 23:37:02 -0700

4.3 would be the wrong behavior. I think it should just be an informative page to let the end-user know something broke.

New text:

          If the request fails due to a missing or invalid redirection URI, the authorization
          server SHOULD inform the end-user of the error, and MUST NOT redirect the end-user's
          user-agent to the invalid redirection URI.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Nick Walker
> Sent: Tuesday, November 16, 2010 3:45 PM
> To: [email-masked]
> Subject: [OAUTH-WG] section 3.2 error in draft-ietf-oauth-v2-10
> 
> This leads to issuing an HTTP 302 response with an invalid Location header if
> the redirect_uri parameter is missing or invalid.
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth