search

bshaffer / oauth2-demo-php

A demo application for running an OAuth2 server
748 stars 279 forks source link

Better Spec Compliance #55

Open avnr opened 9 years ago

avnr commented 9 years ago

http://tools.ietf.org/html/rfc6749#section-3.1.2.5:

The client SHOULD NOT include any third-party scripts (e.g., third-party analytics, social plug-ins, ad networks) in the redirection endpoint response.

Yet the demo's redirect page includes a call to Google Analytics. I know that RFCs' SHOULD NOT is not as severe as MUST NOT, but after all people may be using the demo as a template app and end up exposing tokens via the GA info chain.

bshaffer commented 9 years ago

Good catch! Wow, that's surprising, as from an analytics standpoint this is definitely important info to track.