Re: [OAUTH-WG] Issue: state in web server flow

[Marius Scurtescu <[e-mail]>]

On Mon, Apr 19, 2010 at 2:24 PM, Eran Hammer-Lahav <[e-mail]> wrote:
>
>> -----Original Message-----
>> From: Marius Scurtescu [mailto:[e-mail]]
>> Sent: Monday, April 19, 2010 1:58 PM
>> To: Eran Hammer-Lahav
>> Cc: Dick Hardt; OAuth WG
>> Subject: Re: [OAUTH-WG] Issue: state in web server flow
>>
>> On Mon, Apr 19, 2010 at 11:53 AM, Eran Hammer-Lahav
>> <[e-mail]> wrote:
>> >
>> >
>> >> -----Original Message-----
>> >> From: Marius Scurtescu [mailto:[e-mail]]
>> >> Sent: Monday, April 19, 2010 10:18 AM
>> >
>> >> I don't think it is possible to enforce callbacks without any query
>> parameters.
>> >> See the Drupal example.
>> >
>> > In the Drupal example the client server adds its silly parameters internally.
>> They are not included in what the client provides as its callback URI.
>>
>> Silly?
>
> Yes.
>
>> The query parameter may or may not be visible in the registered callback.
>>
>>
>> > Can you give an actual callback URI example?
>>
>> http://example.com/oauth2/callback
>> equivalent with:
>> http://example.com/index.php?q=oauth2/callback
>
> Why can't the client always use the first?

For the PHP code receiving the callback makes absolutely no
difference, in both cases it sees the second.

The first URL is achieved with Apache doing a rewrite, it acts as a
reverse proxy. The backend code is always called with the query
parameters.


>> > Also, if the client requires query parameters in its callback, it just means it
>> cannot use the client state OAuth parameter.
>>
>> Sure it can, perfectly valid to redirect to:
>> http://example.com/oauth2/callback?code=123&state=qwerty
>> which is the same as:
>> http://example.com/index.php?q=oauth2/callback&code=123&state=qwert
>> y
>
> No, I meant according to the last proposal, the state parameter will be limited to cases where there is no query in the callback URI. This makes it easy for servers to validate the pre-registered URI.

Servers can validate pre-registered URIs even of the callback has
query parameters, including strict matching.


Marius