Subject: [OAUTH-WG] Question on action item to make RedirectURI optional

From: Mike Jones <[email-masked]>
Date: Fri, 27 May 2011 21:08:25 +0000

The minutes from the special meeting included:

TODO: Eran to add extensibility language for this based on requirements.

-    "RedirectURI" should be optional

TODO: Eran to send mail to the list proposing language changes to either change this from REQUIRED to OPTIONAL and add clarifying language, or leave as required and add a pre-defined value for "we're not actually using this".
Is this proposed change just limited to section 4.5?  It seems to make sense to have redirect_uri  be optional in section 4.1.3 as well (access token request using grant_type authorization code).  Since this request is made directly from the client to the authorization server, I don't see why this would be required.  For at least some implementations of the 3-legged flow, it would make sense to not have this be a requirement.

Comments?

                                                                Thanks,
                                                                -- Mike

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 28 May 2011 13:44:17 +0200

wrt section 4.1.3
The redirect_uri parameter should at least be required if the authz 
server sent the authorization code to a redirect_uri passed in by the 
client into the authorization request.
In this case, the authorization server must bind this uri to the authz 
code and require the client to pass the same uri to the tokens endpoint 
again. This way, the authz server is able to detect authorization code 
theft by an intermediary server (which would need to use a different uri 
than the legitimate client).

regards,
Torsten.

Am 27.05.2011 23:08, schrieb Mike Jones:
> TODO: Eran to send mail to the list proposing language changes to 
> either change this from REQUIRED to OPTIONAL and add clarifying 
> language, or leave as required and add a pre-defined value for "we're 
> not actually using this".
>
> Is this proposed change just limited to section 4.5?  It seems to make 
> sense to have redirect_uri  be optional in section 4.1.3 as well 
> (access token request using grant_type authorization code).  Since 
> this request is made directly from the client to the authorization 
> server, I don't see why this would be required.  For at least some 
> implementations of the 3-legged flow, it would make sense to not have 
> this be a requirement.
>
> Comments?
>
>                                                                 Thanks,
>
>                                                                 -- Mike
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Doug Tangren <[email-masked]>
Date: Sat, 28 May 2011 11:46:57 -0400

It's easiest to remember that the redirect_uri in a access token request
must be an exact match as the one passed into the auth code request

If the pre-registered redirect_uri is http://foo.com/authed

an authorization code request's redirect_uri may be
http://foo.com/authed/bar

In the access token request for the returned code, the redirect_uri must be
http://foo.com/authed/bar

-Doug Tangren
http://lessis.me

On Sat, May 28, 2011 at 7:44 AM, Torsten Lodderstedt <
[email-masked]> wrote:

> server

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 29 May 2011 09:20:28 -0700

This applies to 4.1.1 and 4.2.1 only. It must be required in 4.1.3 is must match the location actually used by the server to deliver the code to (regardless of whether the redirection uri was registered or included explicitly with the request).

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Friday, May 27, 2011 2:08 PM
To: [email-masked]
Subject: [OAUTH-WG] Question on action item to make RedirectURI optional

Comments?

                                                                Thanks,
                                                                -- Mike

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 29 May 2011 18:41:30 +0200

why must the redirect_uri be validated if it is pre-registered and not 
included in the authorization request?

regards,
Torsten.

Am 29.05.2011 18:20, schrieb Eran Hammer-Lahav:
>
> This applies to 4.1.1 and 4.2.1 only. It must be required in 4.1.3 is 
> must match the location actually used by the server to deliver the 
> code to (regardless of whether the redirection uri was registered or 
> included explicitly with the request).
>
> EHL
>
> *From:[email-masked] [mailto:[email-masked]] *On 
> Behalf Of *Mike Jones
> *Sent:* Friday, May 27, 2011 2:08 PM
> *To:* [email-masked]
> *Subject:* [OAUTH-WG] Question on action item to make RedirectURI optional
>

---

From: Doug Tangren <[email-masked]>
Date: Sun, 29 May 2011 13:46:13 -0400

-Doug Tangren
http://lessis.me

> included in the authorization request?

I think the preregistered redirect_uri may only require the core components
of where the user will be redirected to after authorization

  The authorization server SHOULD require the client to pre-register
   their redirection URI or at least certain components such as the
   scheme, host, port and path.  If a redirection URI was registered,
   the authorization server MUST compare any redirection URI received at
   the authorization endpoint with the registered URI.

- http://tools.ietf.org/html/draft-ietf-oauth-v2-16#section-2.1.1

What you pre-register determines how you would match the provided
requests' redirect_uris.

It's explicitly required for an explicit location to redirect to on a
request by request basis.

The exact match in 4.1.3 is required to have a binding between the
first and second request in the auth code flow.

I think the idea behind a pre-registered redirect_uri was to limit
where credentials will be sent to after authorization.

In oauth1 someone could supply a redirection "callback" to a
completely different for every request.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 29 May 2011 20:19:54 +0200

we need to distinguish (1) the registration of a redirect uri template for the purpose of validating the actual redirect uri of an authorization transaction and the (2) registration of the redirect uri to be used in all authorization requests of a client. In the later case, there is no need for the pass a redirect uri with every authz request.

Is OAuth supposed to support (2)?

regards,
Torsten.

Doug Tangren <[email-masked]> schrieb:

-Doug Tangren
http://lessis.me

On Sun, May 29, 2011 at 12:41 PM, Torsten Lodderstedt <[email-masked]> wrote:

why must the redirect_uri be validated if it is pre-registered and not included in the authorization request?

I think the preregistered redirect_uri may only require the core components of where the user will be redirected to after authorization

The authorization server SHOULD require the client to pre-register their redirection URI or at least certain components such as the scheme, host, port and path. If a redirection URI was registered, the authorization server MUST compare any redirection URI received at the authorization endpoint with the registered URI.
- http://tools.ietf.org/html/draft-ietf-oauth-v2-16#section-2.1.1 
What you pre-register determines how you would match the provided requests' redirect_uris. 
It's explicitly required for an explicit location to redirect to on a request by request basis. The exact match in 4.1.3 is required to have a binding between the first and second request in the auth code flow. 
I think the idea behind a pre-registered redirect_uri was to limit where credentials will be sent to after authorization. In oauth1 someone could supply a redirection "callback" to a completely different for every request.