Re: [OAUTH-WG] Redirection in authorization code flow: GET vs POST

Josh Mandel <jmandel@gmail.com> Fri, 11 August 2017 20:08 UTC

Return-Path: <jmandel@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8CA71321D0 for <oauth@ietfa.amsl.com>; Fri, 11 Aug 2017 13:08:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u519F8YUv5lo for <oauth@ietfa.amsl.com>; Fri, 11 Aug 2017 13:08:34 -0700 (PDT)
Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB5CD126C7A for <oauth@ietf.org>; Fri, 11 Aug 2017 13:08:33 -0700 (PDT)
Received: by mail-wm0-x235.google.com with SMTP id m85so49349146wma.0 for <oauth@ietf.org>; Fri, 11 Aug 2017 13:08:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=Ua56aqfC6uLLikfoG1SFtyi6kg9kN+kPccD1pk4mhrI=; b=PfH1FhuDhp1/XRVV0E6Kc3m61gHfs4JoK+HjhH3r7XONNYxIsmHpCCAmvVN9gYgOMJ JActPkbdD9+ap4gW3TW6e2Oxdy86eGkVUnl5CASgoFJWqrLz8piJGpO3rUdSMwEHvwuK OGH9dS5NIQO3U0Guhz7B6A0BKUmdi9c6RMLsRSbSrIy2kAFd5zecqAVz7LVRvUjRVQ43 fvFXVLyTZwGgNkuvuUPwFlLVChgF7jmPyoevEJheRsPOaPJu2YuAi+SS2GbxDiXonjJ7 UPvkx2xwExDz6m8jAR1+BeRCa7xYaUPwsKfXEjkKlluDQqd/ifCec8IJhF7YMGSWkpwJ lSIQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=Ua56aqfC6uLLikfoG1SFtyi6kg9kN+kPccD1pk4mhrI=; b=AcBvwNrKUlBufoF2bvGnI8F2HkMtn4hAwrDcDSGHzv9wa5wL/Qizs740vVOTsnqVjz N4g3YpRpvvUSsJDJ7kQNsCa++AQhBwlI1mDHnY+TvwiGmw2tkASP/rSAZwflpvSGle/D rzSIyeLJDNi1c46a4IYU8/bJbhrIS+zWDkQMdBrJpWl+eBcIRNZRyH84uV3ZXN7Ozdra x8MsOf+TBqwn0Ugb+L3fXP/Tycf7KEMRUWYJsaGGSkmqFUfDDqm2Nho/82ZWgDXZhcVb MasiI5duDwnu0cjZZ7oLzl4RWD/faSUhlvxwVvXzreitFyMrT/kOauM+JraxvyuZQux+ moGw==
X-Gm-Message-State: AHYfb5i1VSfVsg6G2EXVfwyUkBXHjL4/tNVRnW2Cfnmyn+qPokjqhohB 5QKLbDYCpyeRxD1TO1PtQi4/JxJBOdb6RHk=
X-Received: by 10.80.186.100 with SMTP id 33mr16082772eds.47.1502482112038; Fri, 11 Aug 2017 13:08:32 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.80.135.83 with HTTP; Fri, 11 Aug 2017 13:08:11 -0700 (PDT)
In-Reply-To: <CANSMLKFFGitCa6f5bqR=Ks-kqf_t=3poFwCMWTtJ=MyvNKUL3A@mail.gmail.com>
References: <CANSMLKFFGitCa6f5bqR=Ks-kqf_t=3poFwCMWTtJ=MyvNKUL3A@mail.gmail.com>
From: Josh Mandel <jmandel@gmail.com>
Date: Fri, 11 Aug 2017 16:08:11 -0400
Message-ID: <CANSMLKGV6O7rJJPtPxP44598rz-RXt4rqt0kGrvtUKsN2DD_jw@mail.gmail.com>
To: "oauth@ietf.org WG" <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="f403045c4be091cf2c05567fe052"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/JCRjuws3V73461EOfM6fusujMwc>
Subject: Re: [OAUTH-WG] Redirection in authorization code flow: GET vs POST
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Aug 2017 20:08:36 -0000

Fixing my "with this technique" url: it should have been
https://gist.github.com/jmandel/4704d1efed8578a67a6f9b600ffd0c63 .

On Fri, Aug 11, 2017 at 4:00 PM, Josh Mandel <jmandel@gmail.com>; wrote:

> Hi All,
>
> I've just encountered a server that performs a redirect (back to the
> client's redirect_uri) via POST instead of GET. This was surprising
> behavior to me and broke my client implementation — but citing chapter and
> verse, the server developer pointed out that https://tools.ietf.org/
> html/rfc6749#section-1.7 says
>
> While the examples in this specification show the use of the HTTP 302
>> status code, any other method available via the user-agent to accomplish
>> this redirection is allowed and is considered to be an implementation
>> detail.
>
>
> Is triggering a POST-based redirect (e.g. with this technique
> <https://gist.github.com/jmandel/4704d1efed8578a67a6f9b600ffd0c63)>) to
> the redirect_url (including url query parameters for state and code) indeed
> considered a "method available via the user-agent to accomplish this
> redirection"? In other words, should a well-behaved OAuth client be
> prepared to receive GETs as well as POSTs to its redirect_uri? If so, what
> would be the considerations for a server choosing between GET and POST?
>
> Best,
>
>   Josh
>