Allow localhost redirect URI to work regardless of the port
If the redirect URI of a registered app is set to http://localhost the redirect URI check must work regardless of the port, so if I start the flow using redirect_uri param to "http://localhost:3000" this should work (same as Github is doing).
This will ease the development of desktop applications that requires oauth2 flow.
-
belst_
commented
This is required for local app support without a server
-
acureus
commented
That would be so great!
It can lead to situations where some people can just never sign in when using oauth2 when i have to limit the localhost port to a fixed one, that i have no idea about whether it's available or not on client machines.
(
Also according to the RFC8252 "OAuth 2.0 for Native Apps" Section 7.3:"The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request."
)