I've been reading the OAuth 1.0a RFC: https://tools.ietf.org/html/rfc5849 . Most of it is pretty clear. However, I have a few questions:

  1. I can't understand why the oauth_callback is sent when obtaining an unauthorized request token. I mean, doesn't it make more sense for it to be sent when redirecting the user to the authorization page? That way, the server doesn't have to store the oauth_callback which is most likely going to be the same for all tokens for the same consumer.

  2. Assume I don't want to store the oauth_callback. I request clients to send the oauth_callback when requesting an unauthorized token with the value oob. Then I request clients to send the oauth_callback in the query string of the authorization page (with the real callback URL). After reading this section I understand this is RFC-compliant and still secure. However, I'd like to hear a second opinion

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.