[OAUTH-WG] Why give the redirect URI when trading an access code for an access token?

"Freeman, Tim" <tim.freeman@hp.com> Thu, 09 September 2010 03:05 UTC

From: "Freeman, Tim" <tim.freeman@hp.com>
To: "oauth@ietf.org" <oauth@ietf.org>
Date: Thu, 09 Sep 2010 03:04:37 +0000
Thread-Topic: Why give the redirect URI when trading an access code for an access token?
Thread-Index: ActPy7z55fqeLYGoQ5ugjINJWPMP0w==
Message-ID: <59DD1BA8FD3C0F4C90771C18F2B5B53A6532547F10@GVW0432EXB.americas.hpqcorp.net>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [OAUTH-WG] Why give the redirect URI when trading an access code for an access token?
Precedence: list

Hi.  I'm new here.  I searched the archives a bit and didn't immediately find an answer to my question below.  My apologies if there was some previous discussion of this that I missed.

Looking at the draft spec at http://tools.ietf.org/html/draft-ietf-oauth-v2-10, I see in section 4.1.1 "Authorization code" on page 22 that it is required to give the redirect_uri of the original request when exchanging an authorization code for an access token, and the authorization server must verify that the redirection URI is correct as well as the authorization code.  Based on section 4.2 "Access Token Response" on page 25, it seems that the redirect_uri is not used when constructing the response from the authorization server.

So far as I can tell, the redirect_uri is useless in this request.  It does not contain any secrets.  The authorization code is verified and is meant to be an arbitrary unguessable identifier, so little is gained by verifying the redirect_uri also.  It is not used to construct the reply.  Why is it required?

Tim Freeman
Email: tim.freeman@hp.com
Desk in Palo Alto: (650) 857-2581
Home: (408) 774-1298
Cell: (408) 348-7536

[OAUTH-WG] Why give the redirect URI when trading… Freeman, Tim
Re: [OAUTH-WG] Why give the redirect URI when tra… Eran Hammer-Lahav
Re: [OAUTH-WG] Why give the redirect URI when tra… Torsten Lodderstedt
Re: [OAUTH-WG] Why give the redirect URI when tra… Eran Hammer-Lahav
Re: [OAUTH-WG] Why give the redirect URI when tra… Torsten Lodderstedt
Re: [OAUTH-WG] Why give the redirect URI when tra… Freeman, Tim
Re: [OAUTH-WG] Why give the redirect URI when tra… Eran Hammer-Lahav
Re: [OAUTH-WG] Why give the redirect URI when tra… Torsten Lodderstedt
[OAUTH-WG] Protocol breaks if states are guessabl… Freeman, Tim