From nobody Thu Dec 3 02:00:09 2020 Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBB7E3A0E0D for ; Thu, 3 Dec 2020 02:00:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBADSWtbX4Y6 for ; Thu, 3 Dec 2020 02:00:05 -0800 (PST) Received: from mail-yb1-xb2a.google.com (mail-yb1-xb2a.google.com [IPv6:2607:f8b0:4864:20::b2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5955A3A0E09 for ; Thu, 3 Dec 2020 02:00:05 -0800 (PST) Received: by mail-yb1-xb2a.google.com with SMTP id x2so1461401ybt.11 for ; Thu, 03 Dec 2020 02:00:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=9GqeY2d0jn3dUtbIpKCzGqN1k7pzzJOdm0jC8wEv1X0=; b=BNWaRqTV2MKkB/8drvb/2s8in417t4DCsco92bgvk2GrHT1W6wMmdOqtxNIFpSN7Pp +W5rMYb0rB7CD0Tt+U/2I5W69zSk6EYMNeJkczMyNI0+cb0eJTLqJLFtw+cVRvEyzZCS Xz/qGPNWAqWtbuSPvCT9NBLiT8YASB66yRxgkM3w8r9PGhTk46HBHJOLIbK4zAH3mcVU GmTL4y72u0M1fLwMqsdZoCtA8MaMIvMSuRsAnCEwebn4JrVytKM62LKicKowSZ+bixSv iScFX+EVF0ysbSpHDHTD3Cg/FLUCPydc8DB3y7oHge45Q0CX89IGEL7seb4PTPgN12Br mNBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=9GqeY2d0jn3dUtbIpKCzGqN1k7pzzJOdm0jC8wEv1X0=; b=VOOVmVuZTrTIHMmqnqt46C4l9tKTLlRCj3bF5akndIUe2m2WoyLdyVf8aaoPDkQOOH DP0JsrnOS7Y08vUtw1P9MvR2QsWpz0s1Hr0ewrMNVZck/49npFqbs0NUcgMLHM2ypmk9 Hy9/jqRfAvWWRCkqe0UGVPXgRW2L7TEoqXFICLsTNHlWYBLpBLmyvaTaM0Vlb7JcZA0B gxA002B7uJtw8siNTm2/v/9lA4jIhhzDgl3cHry4ERF7/2khEhli2ihQuPCsAOaSNBJ9 w2nHDdioieNeWjF1FXGmNz2TjbWnN31hCSi6+kE3+MzWuNXufK5ju0emQEjEwidlNwr4 MoSw== X-Gm-Message-State: AOAM532YsL4sWsj+iYdFzrZZ7KULUKQhXW0dllHp3P1ByekGRBjo6K/x LyEzFhqjRb3oB9W57JxJQnyfh3WaMAuaLb8nnhM/cIApbg== X-Google-Smtp-Source: ABdhPJzZbpfdQib2SHG/fPHtJUj+M5Zn903p3ZeXiQSti3tDPj9IEdsnKRjPF8r/fQuQAvgkUEV/1algCvkbVPNIGjA= X-Received: by 2002:a25:209:: with SMTP id 9mr3576473ybc.127.1606989604039; Thu, 03 Dec 2020 02:00:04 -0800 (PST) MIME-Version: 1.0 From: Filip Skokan Date: Thu, 3 Dec 2020 10:59:28 +0100 Message-ID: To: oauth Content-Type: multipart/alternative; boundary="00000000000081ae3005b58c6c9c" Archived-At: Subject: [OAUTH-WG] OAuth 2.1 + OAuth 2.0 for Native Apps: Private-Use URI Scheme Redirection enforcement X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 10:00:07 -0000 --00000000000081ae3005b58c6c9c Content-Type: text/plain; charset="UTF-8" Hello everyone, Both RFC 8252 and OAuth 2.1 draft state that (paraphrasing) Apps MUST use a URI scheme based on a domain name under their control, > expressed in reverse order, as recommended by Section 3.8 of [RFC7595] for > private-use URI schemes. e.g. com.example.app:/ My question is, is the AS right to reject client registrations that do not follow this specific requirement, to e.g. reject myapp:/oauth2/example-issuer on the account of it not being neither claimed https scheme, an http: + loopback interface, nor having a "." (dot) character suggesting it is a reverse domain scheme? Best, *Filip* --00000000000081ae3005b58c6c9c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello everyone,

Both RFC = 8252 and OAuth 2.1 draft state that (paraphr= asing)

Apps MUST use a URI scheme based on a domain name under their control= , expressed in reverse order, as recommended by Section 3.8 of [RFC7595] fo= r private-use URI schemes. e.g.=C2=A0com.example.app:/

My question is, is the AS right t= o reject client registrations that do not follow this specific requirement,= to e.g. reject=C2=A0myapp:/oauth2/example-issuer on the acco= unt=C2=A0of it not being neither claimed https scheme, an http:=C2=A0+ loop= back interface, nor having a "." (dot) character suggesting it is= a reverse domain scheme?

Best,
Filip
--00000000000081ae3005b58c6c9c--