2

I need authentication for my app so I used the implicit flow way. The authentication works just fine but the access_token and expires variables return weirdly!

For example:

https://example.com/#access_token=cLTLp72w9VkU08MssPxkYNOg))&expires=86400

Shouldn't it be ? instead of #? I can't access the variables.

Improve this question

1 Answer 1

Reset to default
1

Refer to the generic URI syntax, it is perfectly valid to have a fragment (The optional part of a URL that starts with an octothorpe #) without a preceding query (The optional part of a URL that starts with a question mark ?).

This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, it is as specified in RFC 6749.

The idea was that, by passing the data in the hash, this may make it harder for third-party servers or websites to access. See also OAuth2.0 Implicit Grant flow. Why use url hash fragments?.

Most languages, that you would write an app in, provide shortcuts to get at this fragment -- which usually called the URL hash.
For example, in JavaScript you would use location.hash.

Improve this answer
1
  • thank you, turns out i need too use explict flow for authentication because my app is server side not client side.
    – moein rahimi
    Commented Apr 4, 2016 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .