Skip to content

Conversation

zopieux
Copy link
Contributor

@zopieux zopieux commented Jan 14, 2015

redirect_uri is supposed to handle arbitrary schemes as per the RFC; this is especially useful for mobile app handlers eg. mobile-app://my/callback?code=....

To this end, this PR implements UnsafeHttpResponseRedirect in oauth2_provider/views/http.py that does the same thing as HttpResponseRedirect except it does not check the scheme, as it is already done in the various validators.
It's a shame there is no base class in django.http to do the Location header stuff without the check, but anyway.

A test has been added to check this bugfix.

See #154 and #155 for discussions regarding the validation of the redirect_uri field iself.

@coveralls
Copy link

Coverage Status

Coverage increased (+0.01%) when pulling cb1f090 on Zopieux:fix-urlredirect-schemes into 060022f on evonove:master.

@zopieux
Copy link
Contributor Author

zopieux commented Jan 14, 2015

One Travis job failed because of a Django1.6 tarball wrong checksum.

@synasius
Copy link
Contributor

#155 it's now merged!

@synasius synasius closed this Jan 15, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants