Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
From: Justin Richer <jricher@mit.edu>
In-Reply-To: <CAOahYUzV2hn0cdbpZf6zqm70aWEt6fOiUm6ttfS7Ai6FrF+ofw@mail.gmail.com>
Date: Tue, 19 Jan 2016 11:29:05 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <8D27A368-436A-4DBA-96B6-8CC76253F7AF@mit.edu>
References: <CAOahYUzV2hn0cdbpZf6zqm70aWEt6fOiUm6ttfS7Ai6FrF+ofw@mail.gmail.com>
To: Lewis Adam-CAL022 <Adam.Lewis@motorolasolutions.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/qanACbwZQKbkD7fgb-7lD3UIGUs>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] best practice for Native app + state param?
Precedence: list

I think there=E2=80=99s no advice because it=E2=80=99s not different: =
you should still be using the state parameter. Just use a random value =
with high enough entropy, which is also what most web applications do =
(the advice in the spec is weird and I think a remnant of Bradley making =
things too complicated in his advice). In a web app, it gets tied to the =
session cookie back on the server, you don=E2=80=99t need any =
particularly fancy binding beyond your usual session management. In a =
native app, just store it in the application before you send it and look =
it up on the way back to make sure it matches. Combine this with PKCE =
and you=E2=80=99ve got a pretty solid set of protections for native =
apps.

 =E2=80=94 Justin

> On Jan 19, 2016, at 10:18 AM, Adam Lewis =
<Adam.Lewis@motorolasolutions.com> wrote:
>=20
> Hi,
>=20
> I have not been able to find any usage for the state parameter in =
authorization requests for native apps.  Further, the spec guidance of =
using a hash of the session cookie as the value of the state param =
doesn't apply for native apps.
>=20
> draft-wdenniss-oauth-native-apps is silent on the matter.
>=20
> Usage of state seems to be unique to clients conforming to the web app =
profile.
>=20
> Bottom line, looking to vet that it's safe to omit the state parameter =
in the authorization request for native apps, and that I'm not missing =
something critical.
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth