3

I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC document, under 3.1.2, it states

The endpoint URI MUST NOT include a fragment component.

How come this is "MUST NOT"? Are there any security considerations here? I clearly do not want to redirect using simple query params for user-agent clients as they are available during transition. I've noticed OIDC implements this using hash fragments, but I'm wondering why OAuth 2.0 discourage this? Any takes?

If the question has been answered previously I appreciate help with linking to the question.

EDIT:

I'm wondering If I have misunderstood the phrasing used, could the endpoint URI point to the URI BEFORE appending access_tokens? aka. the endpoint URI's registered for the client, "redirect_uri" and not the actual redirected URI. I assume this because one wouldn't want two fragments in the redirected URI.

|improve this question
1

You are right. RFC 6749 says the endpoint URI without the appended access token or authorization code is the one that MUST NOT contain a fragment.

The reasoning probably is that there would be two fragments after the redirection as the authorization code or the access token get appended during the execution of the grant.

|improve this answer
0

Unable to post as a comment, but it may be beneficial to preserve privacy, but then again may not work with devices using custom/integrated URIs on mobile phones. The browser might not relay the fragment to the app, and the app might not send the fragment to the browser.

|improve this answer
  • I believe there is another RFC for native apps. I'm more concerned with the use of user-agent clients, such as Javascript SPA. I've noticed that the RFC further down mentions the use of fragments. However, currently it seems like there are opposites in the document. One part saying MUST NOT the other saying SHOULD use fragments. – CompSci Sep 11 '19 at 20:08
  • @GjertG I can't find a part that says you SHOULD use fragments for some endpoints. Endpoints MUST NOT be defined containing fragments. But information is transferred as fragment - for example the access token in the implicit flow. – BenjaminH Sep 12 '19 at 8:17
  • @BenjaminH Hi, would you check the update? Just want to make sure where on the same page. However, I would assume the reason why the endpoints should not be defined with fragments is to avoid error when transfering data through fragments? If thats the case I think I get it – CompSci Sep 12 '19 at 8:30
  • 1
    @GjertG Yes. The redirection_uri defined is the one without the appended token! I think your reasoning that there should not be two fragments appended is the main reason for this "MUST NOT". – BenjaminH Sep 12 '19 at 10:51
  • @BenjaminH Awesome, must have misunderstood the phrasing then, I'll accept your answer if you post one – CompSci Sep 12 '19 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.