Re: [OAUTH-WG] user-agent flow needs a rewrite

Isn't that better overall than requiring the browser to make another HTTP request to pass the code over?

EHL

On 7/13/10 11:17 AM, "Brian Eaton" <beaton@google.com> wrote:

On Tue, Jul 13, 2010 at 9:42 AM, David Recordon <recordond@gmail.com> wrote:
>> That strikes me as very odd - returning some params in the query, and
>> others in the fragment is just weird.
>
> I actually think that you want this - albiet odd - combination when
> requesting both a code and token. The code and state parameters are needed
> by the server and thus are query parameters. The access token, scope, and
> expires in shouldn't be sent to the server via HTTP and thus are within
> the fragment for the JavaScript to access.

The problem is that if you do it this way you end up busting the
browser cache.  All of the performance improvements offered by the
user-agent profile are lost.

Cheers,
Brian
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth