[OAUTH-WG] OAuth 2.1 + OAuth 2.0 for Native Apps: Private-Use URI Scheme Redirection enforcement

[Filip Skokan <[e-mail]>]

Hello everyone,

Both RFC 8252 <https://tools.ietf.org/html/rfc8252#section-7.1> and OAuth
2.1 draft
<https://tools.ietf.org/html/draft-ietf-oauth-v2-1-00#section-10.3.1> state
that (paraphrasing)

Apps MUST use a URI scheme based on a domain name under their control,
> expressed in reverse order, as recommended by Section 3.8 of [RFC7595] for
> private-use URI schemes. e.g. com.example.app:/


My question is, is the AS right to reject client registrations that do not
follow this specific requirement, to e.g. reject myapp:/oauth2/example-issuer
on the account of it not being neither claimed https scheme, an http: +
loopback interface, nor having a "." (dot) character suggesting it is a
reverse domain scheme?

Best,
*Filip*