Allow database-configured redirect_uri to be a URL prefix #38
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joestump
pushed a commit
to sprintly/django-oauth2-provider
that referenced
this pull request
Jan 18, 2017
…index-code Remove 1.1.2 index code
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, if the consumer provides a
redirect_uriparameter, its value must be an exact match to the configuredredirect_uriin the Client table.Some oauth consumers expect to receive a response at an unspecified path beneath a certain domain or domain+base path. It would be useful to allow the configured
redirect_urito specify the base URL that must be matched, without requiring an exact match.This patch adds a new configurable setting,
OAUTH_REDIRECT_URI_ENFORCED_PREFIX_ONLY. If it is set toTrue, thenredirect_urivalidation only enforces that the client'sredirect_uriparameter starts with the value ofClient.redirect_uri, rather than checking that they are identical.By default this setting is
Falseso the current behavior is unchanged by default.