[Security Problem] authorization_code access token request does not verify redirection URI

socialcast / devise_oauth2_providable

Rails3 engine integrating OAuth2 authentication with Devise

MIT License

219 stars 102 forks source link

[Security Problem] authorization_code access token request does not verify redirection URI #32

Open NadaAldahleh opened 12 years ago

NadaAldahleh commented 12 years ago

According to http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-4.1.3 the authorization server must validate that the redirection URI matches the redirection URI used by the authorization server to deliver the authorization code. It currently ignores it. (This is in addition to ignoring the client_secret as describe in issue 25)