Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

I've set an OAuth domain for an application (the client_id is 24) and the following link authorizes the application:

https://stackexchange.com/oauth/dialog?client_id=24&scope=no_expiry,read_inbox&redirect_uri=https://stackexchange.com/oauth/login_success

I can assure you that the redirect_uri is not within the registered domain for my application.

Why is this not producing an error?

share|improve this question
    
I think the only URL outside the registered domain that is accepted is https://stackexchange.com/oauth/login_success, because it's on StackExchange it's trusted already. –  Jonathan. Jan 19 '12 at 21:34
    
@Jonathan: Yeah, but that isn't documented anywhere. –  Nathan Osman Jan 19 '12 at 22:05
add comment

1 Answer

up vote 1 down vote accepted

This is .

You'll note on the authentication documentation:

Desktop applications cannot participate directly in OAuth 2.0 flows, however the embeddable browser controls available in most frameworks make it possible to work around this limitation.

Desktop applications should use the implicit client-side flow, hosting the process within a browser control. For redirect_uri, a value of https://stackexchange.com/oauth/login_success should be used. Upon a successful authentication, access_token will be placed in the url hash as with a standard implicit authentication.

However, I can see that some developers may want the peace of mind that comes from this not being available.

You can now disable this behavior on your application's edit page.

enter image description here

share|improve this answer
1  
Ah, thanks for the clarification. –  Nathan Osman Jan 20 '12 at 1:14
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .