{"action":"created","issue":{"url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/631","labels_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/631/labels{/name}","comments_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/631/comments","events_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/631/events","html_url":"https://github.com/doorkeeper-gem/doorkeeper/issues/631","id":68376933,"number":631,"title":"Some Flows Redirect URI issues","user":{"login":"dhbahr","id":5192983,"avatar_url":"https://avatars.githubusercontent.com/u/5192983?v=3","gravatar_id":"","url":"https://api.github.com/users/dhbahr","html_url":"https://github.com/dhbahr","followers_url":"https://api.github.com/users/dhbahr/followers","following_url":"https://api.github.com/users/dhbahr/following{/other_user}","gists_url":"https://api.github.com/users/dhbahr/gists{/gist_id}","starred_url":"https://api.github.com/users/dhbahr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhbahr/subscriptions","organizations_url":"https://api.github.com/users/dhbahr/orgs","repos_url":"https://api.github.com/users/dhbahr/repos","events_url":"https://api.github.com/users/dhbahr/events{/privacy}","received_events_url":"https://api.github.com/users/dhbahr/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-04-14T13:35:37Z","updated_at":"2015-04-24T20:40:26Z","closed_at":"2015-04-24T16:58:09Z","body":"First of all I'll say that my client application is not written on ruby, hence does not use Doorkeeper internally. I'm processing Doorkeeper responses manually. That being said:\r\n\r\nFor some reason (Authorization Code and Resource Owner Password Credentials both work fine on this) the Implicit Grant flow callback to the Redirect URI sends parameters with a '#' rather than a '?', that is: \r\nhttp://www.example.com/oauth_cb#access_token=c2a3...\r\nrather than\r\nhttp://www.example.com/oauth_cb?access_token=c2a3...\r\n\r\nIs this the expected behavior?\r\n\r\nBy the way: I'm using 2.1.3, would update to 2.1.4 fix that for me?\r\n\r\nBest regards\r\n"},"comment":{"url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/comments/96058937","html_url":"https://github.com/doorkeeper-gem/doorkeeper/issues/631#issuecomment-96058937","issue_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/631","id":96058937,"user":{"login":"dan-corneanu","id":3323270,"avatar_url":"https://avatars.githubusercontent.com/u/3323270?v=3","gravatar_id":"","url":"https://api.github.com/users/dan-corneanu","html_url":"https://github.com/dan-corneanu","followers_url":"https://api.github.com/users/dan-corneanu/followers","following_url":"https://api.github.com/users/dan-corneanu/following{/other_user}","gists_url":"https://api.github.com/users/dan-corneanu/gists{/gist_id}","starred_url":"https://api.github.com/users/dan-corneanu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dan-corneanu/subscriptions","organizations_url":"https://api.github.com/users/dan-corneanu/orgs","repos_url":"https://api.github.com/users/dan-corneanu/repos","events_url":"https://api.github.com/users/dan-corneanu/events{/privacy}","received_events_url":"https://api.github.com/users/dan-corneanu/received_events","type":"User","site_admin":false},"created_at":"2015-04-24T20:40:26Z","updated_at":"2015-04-24T20:40:26Z","body":"The # part of the URI is called fragment identifier.\r\nThe OAuth 2.0 specification, clearly states that for the *Implicit Grant* flow, the access token should be encoded in the fragment identifier of the redirect URI. Please see section *4.2.2.  Access Token Response* at http://www.rfc-base.org/txt/rfc-6749.txt\r\n\r\nAs far as I can tell, this is expected behavior and conforms to the specification.\r\n\r\nThe reason for using the fragment identifier is somehow security related. The fragment identifier doe not get passed by the user agent to the server (never) and so the chances of it getting logged somewhere and licking to a 3rd party are mitigated.\r\n\r\nEx. query parameters (that appear in your browser's location bar) are sent in the Referer [sic] HTTP header when the user agent makes a request for a resource imbedded in your page (like an image, font etc.) Thus they can be logged by proxies or other server side component.\r\n\r\nHope this helps."}}