isaacsanders / omniauth-stripe-connect

Stripe Connect OAuth2 Strategy for OmniAuth 1.0
MIT License
130 stars 75 forks source link

Removed the unsupported `redirect_uri` parameter. #15

Closed tsmango closed 11 years ago

tsmango commented 11 years ago

I was contacted by Stripe last week and informed that they don't consider the redirect_uri parameter as valid when it's sent to the /oauth/authorize connect endpoint.

Currently, they're ignoring this parameter, but do have plans to support it in the future.

However, as of September 30, 2013, they will start returning an error on invalid redirect_uri parameters sent to the connect endpoint.

To avoid this issue, this pull request simply stops sending the redirect_uri parameter to the connect endpoint.

The redirect_uri parameter should be specified in your Stripe dashboard, when configuring your OAuth application.

metcalf commented 11 years ago

Note that we do allow you to pass a redirect_uri parameter but it must exactly match one of the (comma-separated) values in your dashboard. One alternative is to configure them to match on the app level:

# In place of existing provide line
provider :stripe_connect, ENV['STRIPE_CONNECT_CLIENT_ID'], ENV['STRIPE_SECRET'], { :callback_path => '/my/auth/path' }

# Somewhere in global app config
OmniAuth.config.full_host = 'https://foo.com'

My other suggestion would be to omit the redirect_uri parameter from the request unless it is configured at the app level. In other words, omit it if OmniAuth.config.full_host.nil? && options[:callback_path].nil?

tsmango commented 11 years ago

Okay, after getting further clarification from @narced133 over email, I'm closing this pull request. I misunderstood the original email I received from Stripe relating to this parameter and the upcoming changes.