Keep track of client applications `state`

earaujoassis / space

🚀 A user management microservice; OAuth 2 provider

MIT License

17 stars 6 forks source link

Keep track of client applications `state` #24

Closed earaujoassis closed 8 years ago

earaujoassis commented 8 years ago

When a client application sends a state attribute in the authorisation process, we should track that state and send it back to the client application and make sure it is the same across the whole authentication/authorisation process.

earaujoassis commented 8 years ago

The RFC 6749 doesn't state that the client application should send a state attribute when requesting a token session, after the authorization step (https://tools.ietf.org/html/rfc6749#section-4.1). Thus we're not implementing the following requirement for the version 0.1.0.