Re: [OAUTH-WG] Issue: state in web server flow

[Marius Scurtescu <[e-mail]>]

On Sun, Apr 18, 2010 at 10:36 PM, Dick Hardt <[e-mail]> wrote:
>
> On 2010-04-18, at 10:28 PM, Eran Hammer-Lahav wrote:
>
>>
>>
>>> -----Original Message-----
>>> From: [e-mail] [mailto:[e-mail]] On Behalf
>>> Of Dick Hardt
>>> Sent: Sunday, April 18, 2010 9:20 PM
>>> To: OAuth WG
>>> Subject: [OAUTH-WG] Issue: state in web server flow
>>>
>>> Why was the state parameter removed from the web server flow?
>>
>> I didn't want to both define a state parameter *and* allow for any other client-specific parameters in redirection URIs. Because people made the point that *any* client-specific parameters are required, I proposed to drop the state parameter. After all, servers MUST send back whatever URI they receive regardless of it being encoded into a state parameter.
>>
>>> Some AS may require the entire redirect URI to be registered, so the state
>>> parameter allows a client to maintain state across calls.
>>
>> I agree that this is useful, but it only makes the spec better if we make its use more restrictive. Defining it makes it easier for servers to validate the redirection URI, but only if the client is not allowed using other client-specific query parameters with it.
>
> Agreed
>
>>
>> If people feel strongly about putting it back, I suggest we only allow it with callbacks without any query component as that is the only combination it adds value.
>
> Agreed

I don't think it is possible to enforce callbacks without any query
parameters. See the Drupal example.

What we can enforce is that the registered callback and the actual
callback have the exact same query parameters.

Marius