In an OAuth2 scenario:

  • user confirmed his identity, allows the app to access his details
  • server got the external access token

I intend to respond directly with a local access token as opposed to redirecting to a Uri containing the external access token fragment.

Is there a point in obtaining local access token in a separate request, based on the external token?

Is there something more than meets the eye in a redirect when returning a security token to the user?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.