1

I've set an OAuth domain for an application (the client_id is 24) and the following link authorizes the application:

https://stackexchange.com/oauth/dialog?client_id=24&scope=no_expiry,read_inbox&redirect_uri=https://stackexchange.com/oauth/login_success

I can assure you that the redirect_uri is not within the registered domain for my application.

Why is this not producing an error?

Improve this question
2
  • I think the only URL outside the registered domain that is accepted is https://stackexchange.com/oauth/login_success, because it's on StackExchange it's trusted already.
    – Jonathan.
    Commented Jan 19, 2012 at 21:34
  • @Jonathan: Yeah, but that isn't documented anywhere.
    – Nathan Osman
    Commented Jan 19, 2012 at 22:05

1 Answer 1

Reset to default
2

This is .

You'll note on the authentication documentation:

Desktop applications cannot participate directly in OAuth 2.0 flows, however the embeddable browser controls available in most frameworks make it possible to work around this limitation.

Desktop applications should use the implicit client-side flow, hosting the process within a browser control. For redirect_uri, a value of https://stackexchange.com/oauth/login_success should be used. Upon a successful authentication, access_token will be placed in the url hash as with a standard implicit authentication.

However, I can see that some developers may want the peace of mind that comes from this not being available.

You can now disable this behavior on your application's edit page.

enter image description here

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .