It can lead to situations where some people can just never sign in when using oauth2 when i have to limit the localhost port to a fixed one, that i have no idea about whether it's available or not on client machines.
(
Also according to the RFC8252 "OAuth 2.0 for Native Apps" Section 7.3:
"The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request."
)
That would be so great!
It can lead to situations where some people can just never sign in when using oauth2 when i have to limit the localhost port to a fixed one, that i have no idea about whether it's available or not on client machines.
(
Also according to the RFC8252 "OAuth 2.0 for Native Apps" Section 7.3:
"The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request."
)