Re: [OAUTH-WG] conflict: error response invalid_request and state parameter duplication

[Justin Richer <[e-mail]>]

None, it responds with an error (400) and not a redirect (302). You 
don't include the state parameter on an error response, only on a valid 
redirection response.

  -- Justin

On 12/20/2011 01:57 AM, Alexey Skolyarov wrote:
>
> I see that. But how the server should respond on incorrect request 
> (when it’s not possible to determine correct state to be passed).
>
> Specifically, what state should be passed to the client – no one, any 
> or all of them?
>
> -- 
> Best regards, Alexey Skolyarov
> Dino Systems Java Team
> Phone: [phone] ext. 4161Skype: alexey.skolyarov
>
> Cell: [phone] Mailto: [e-mail] 
> <mailto:[e-mail]>
>
> *From:*Justin Richer [mailto:[e-mail]]
> *Sent:* Monday, December 19, 2011 7:01 PM
> *To:* Alexey Skolyarov
> *Cc:* Buhake Sindi; [e-mail]
> *Subject:* Re: [OAUTH-WG] conflict: error response invalid_request and 
> state parameter duplication
>
> The spec already says that you can't repeat request parameters on the 
> line like that, so that's an invalid_request error, as described in 
> section 5.2:
>
>
>       5.2.  Error Response
>
>   
>   
>     The authorization server responds with an HTTP 400 (Bad Request)
>     status code and includes the following parameters with the response:
>   
>     error
>           REQUIRED.  A single error code from the following:
>           invalid_request
>                 The request is missing a required parameter, includes an
>                 unsupported parameter value, repeats a parameter,
>                 includes multiple credentials, utilizes more than one
>                 mechanism for authenticating the client, or is otherwise
>                 malformed.
>
>
>
>  -- Justin
>
> On 12/19/2011 08:20 AM, Alexey Skolyarov wrote:
>
> Hello Buhake,
>
> Thanks for your answer!
>
> It seems I should explain a bit here – I’m not about how to pass the 
> state with multiple values, I’m trying to figure out how the 
> OAuth-2.0-draft-22 – compliant server should respond on duplication of 
> state request parameter.
>
> For instance what should be returned in response on following request:
>
> GET 
> /authorize?response_type=code&client_id=s6BhdRkqt3&*state=QWE*&*state=ASD*&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb 
> HTTP/1.1
>
> Host: server.example.com
>
> It’s unclear for me should it be
>
> HTTP/1.1 302 Found
>
> Location: https://client.example.com/cb?error=invalid_request (without 
> the state completely – seems to be wrong beforehand)
>
> or
>
> HTTP/1.1 302 Found
>
> Location: 
> https://client.example.com/cb?error=invalid_request&state=QWE 
> <https://client.example.com/cb?error=invalid_request&state=QWE>( or 
> ASD - one of passed states used)
>
> or
>
> HTTP/1.1 302 Found
>
> Location: 
> https://client.example.com/cb?error=invalid_request&state=QWE%20ASD 
> <https://client.example.com/cb?error=invalid_request&state=QWE%20ASD> 
> (both but violates the idea that state should be kept unchanged).
>
> I hope this example could make my question clearer.
>
> Thanks in advance.
>
> -- 
> Best regards, Alexey Skolyarov
>
>
> *From:*Buhake Sindi [mailto:[e-mail]]
> *Sent:* Monday, December 19, 2011 4:53 PM
> *To:* Alexey Skolyarov
> *Subject:* Re: [OAUTH-WG] conflict: error response invalid_request and 
> state parameter duplication
>
> Hi Alexey,
>
> If I'm not mistaken, to declare multiple values in "state", the 
> document states that it should be space-delimited (" "). This is 
> unlike Facebook state which is comma-delimited.
>
> On 19 December 2011 14:41, Alexey Skolyarov <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
> Hello everybody,
>
> Since this is my first post on this list, I’ll say few words about whoami:
>
> My name is Alexey Skolyarov, I work in Saint-Petersburg, Russia. I’m 
> interested in OAuth2 because I found no v2 providers for Jersey 
> <http://jersey.java.net/> except Spring Security which is much more 
> complex than 1.0a implementation in Jersey-contrib. Currently I’m 
> under NDA, so I can’t say more L
>
> Nevertheless we’ve done specification study and found a conflict – in 
> last paragraph of section 3.1. "Authorization Endpoint" 
> <http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-3.1> it is 
> mentioned that “/Request and response parameters MUST NOT be included 
> more than once/”.
>
> This statement conflicts with /state/ parameter definition in section 
> 4.1.2.1 "Error response" 
> <http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.1.2.1>, 
> where it’s said that state is “/REQUIRED if a valid "state" parameter 
> was present in the client  authorization request.  The exact value 
> received from the client/”.
>
> How passing /state=QWE&state=ASD/ inside same request should be 
> handled then?
>
> From one hand it is forbidden to process requests with multiple 
> parameter occurrences.
>
> But from another hand Specification requires to pass the state if it 
> was found in a request.
>
> Violation of any of these statements can be treated as “partial 
> compliance” to draft-22, so I’m in doubt what way is preferred there.
>
> What do you guys think?
>
> Thanks in advance.
>
> -- 
> Best regards, Alexey Skolyarov
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
> -- 
> The Elite Gentleman
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]  <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/oauth
>