Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the OAuth server that causes the browser redirect. I am wondering why the auth_code is not served in the body of a webpage generated by the OAuth server; thus sending back regular HTTP 200 response. Is there any security implication associated to serving the auth_code over redirect_uri instead of serving inside the body of the webpage?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.