It looks like doorkeeper always requires the redirect_uri parameter to be set in authorization requests.
|
def validate_redirect_uri |
|
return false if redirect_uri.blank? |
|
|
|
Helpers::URIChecker.valid_for_authorization?( |
|
redirect_uri, |
|
client.redirect_uri, |
|
) |
|
end |
This does not seem to be compliant to RFC 6749 - The OAuth 2.0 Authorization Framework:
-
4.1.1. Authorization Request lists redirect_uri as OPTIONAL
-
4.1.3. Access Token Request lists redirect_uri only as REQUIRED if it was supplied in the authorization request
-
3.1.2.3. Dynamic Configuration clarifies that redirect_uri is REQUIRED only in case no redirection URI has been specified during client registration:
If multiple redirection URIs have been registered, if only part of the redirection URI has been registered, or if no redirection URI has been registered, the client MUST include a redirection URI with the authorization request using the "redirect_uri" request parameter.
When a redirection URI is included in an authorization request, the authorization server MUST compare and match the value received against at least one of the registered redirection URIs (or URI components) as defined in [RFC3986] Section 6, if any redirection URIs were registered. If the client registration included the full redirection URI, the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986] Section 6.2.1.
I understand that by default, doorkeeper also does not allow leaving the redirect url blank during client registration (but it can be changed in the configuration).
Expected behavior
- if client registered a redirection URI, the
redirect_uri parameter is optional in the authorization request
- the
redirect_uri parameter is only required in the access token request if it was specified in the authorization request. In this case, it must match
Actual behavior
redirect_uri parameter is always required in the authorization request and access token request
Related
It looks like doorkeeper always requires the
redirect_uriparameter to be set in authorization requests.doorkeeper/lib/doorkeeper/oauth/pre_authorization.rb
Lines 100 to 107 in 9fc81d5
This does not seem to be compliant to RFC 6749 - The OAuth 2.0 Authorization Framework:
4.1.1. Authorization Request lists
redirect_urias OPTIONAL4.1.3. Access Token Request lists
redirect_urionly as REQUIRED if it was supplied in the authorization request3.1.2.3. Dynamic Configuration clarifies that
redirect_uriis REQUIRED only in case no redirection URI has been specified during client registration:I understand that by default, doorkeeper also does not allow leaving the redirect url blank during client registration (but it can be changed in the configuration).
Expected behavior
redirect_uriparameter is optional in the authorization requestredirect_uriparameter is only required in the access token request if it was specified in the authorization request. In this case, it must matchActual behavior
redirect_uriparameter is always required in the authorization request and access token requestRelated
redirect_uriis not compliant to RFC 6749 openstreetmap/openstreetmap-website#4363