Subject: [OAUTH-WG] Remove the callback_url from OAuth web server flow response

From: Luke Shepard <[email-masked]>
Date: Fri, 9 Apr 2010 01:09:49 -0700

In the Web Callback Flow, section 3.4.1.2 requires the client to pass the "callback" parameter back a second time.

Why?

I believe this is supposed to be there to prevent session fixation attack, but I don't see an attack vector where the verification code is not sufficient to prevent things. It seems redundant and confusing, and I'd like to remove it (I believe this was proposed on a separate thread)