How to pass several parameters to your redirect Uri?
To pass several parameters to your redirect uri, have them stored in state parameter before calling Oauth url, the url after authorization will send the same parameters to your redirect uri as state=THE_STATE_PARAMETERS This is a PHP example of base64UrlEncoding & decoding ( http://en.wikipedia.org/wiki/Base64#URL_applications) :
Why does response.redirect break when you encode an url?
All seems well if you do this: But if you have already correctly encoded the URL then it breaks: This is because the Response.Redirect takes what may be called a speculative approach to deciding how to encode the URL that you provide to it.
How to encode URL parameters in JavaScript?
And I want to pass the parameters such as an image URL which is generated itself by another API, and the link for the image turns out as: It doesn’t work. I have also tried using encodeURI () and encodeURIComponent () on the imageURL, and that too doesn’t work.
Why is response redirect not compatible with HTTP referrer?
This is because the Response.Redirect takes what may be called a speculative approach to deciding how to encode the URL that you provide to it. This helps most ASP programmers to get the correct behaviour but means that the code is not compatible with, for example, redirecting back to a HTTP referrer ²
What does the scope mean in OAuth2 redirect?
The scope represents what the resource server is requesting access to from the OAuth provider. The redirect_url to be used during the Authorization code grant step. In our example the entry point is https://resource-server.com/users/auth/google_oauth2 /callback. Once again, the route is provided by the devise gem.
When to re-hydrate an OAuth redirect Uri?
Rather than passing (read exposing) data it should be kept local. Hydrate it before the request and re-hydrate it after a validated request. “Validated” here means that the state-nonce of request and response match. You need some kind of temporary client side storage.
What should be used as a parameter in OAuth?
E.g. for SPA or general websites keep it in state or use the browser’s localStorage, a session (or a signed cookie). For mobile apps they should use memory or any other local storage. Before sending the request generate a nonce (see below) that will be used as state parameter for the request.