Re: [OAUTH-WG] user-agent flow needs a rewrite

[David Recordon <[e-mail]>]

On Tue, Jul 13, 2010 at 1:06 AM, Luke Shepard <[e-mail]> wrote:

> I just read this bit:
>
>    If the response type is "code_and_token", the authorization server
>    adds the "code" and "state" parameters to the redirection URI query
>    component and the "access_token", "scope", and "expires_in" to the
>    redirection URI fragment using the
>    "application/x-www-form-urlencoded" format as defined by
>
> That strikes me as very odd - returning some params in the query, and
> others in the fragment is just weird.
>

I actually think that you want this – albiet odd – combination when
requesting both a code and token. The code and state parameters are needed
by the server and thus are query parameters. The access token, scope, and
expires in shouldn't be sent to the server via HTTP and thus are within
the fragment for the JavaScript to access.


I think the request should specify whether it wants the response in the
> fragment or query.
>

You can't always put them into the query because you'd be exposing an access
token over HTTP. If you always put them into the fragment then you need to
write JavaScript which passes the code and state down to the server.