In an OAuth2 scenario:
- user confirmed his identity, allows the app to access his details
- server got the external access token
I intend to respond directly with a
local access token as opposed to redirecting to a Uri containing the
external access token fragment.
Is there a point in obtaining local access token in a separate request, based on the external token?
Is there something more than meets the eye in a redirect when returning a security token to the user?