When authorizing an application using OAuth2 and authorization code flow , the authorization server must redirect the user back to the application via a redirect_uri. The redirect URI is defined as optional in the RFC 6749 spec but is actually fundamental to specific flows. Attempting to authorize an application using authorization code flow without a redirect uri will simply not work with most (possibly all?) authorization servers (e.g. keycloak). Hence, for the authorization code flow, it is basically a requirement that a redirect uri also be supplied. My proposal is that redirect uri be added as an optional parameter to the oauth2 security definition so as to satisfy the ability to authorize applications as a first class concept.
This request was born out of the following discussion relating to swagger-editor / swagger-ui swagger-api/swagger-editor#1410 (comment)
When authorizing an application using OAuth2 and authorization code flow , the authorization server must redirect the user back to the application via a redirect_uri. The redirect URI is defined as optional in the RFC 6749 spec but is actually fundamental to specific flows. Attempting to authorize an application using authorization code flow without a redirect uri will simply not work with most (possibly all?) authorization servers (e.g. keycloak). Hence, for the authorization code flow, it is basically a requirement that a redirect uri also be supplied. My proposal is that redirect uri be added as an optional parameter to the oauth2 security definition so as to satisfy the ability to authorize applications as a first class concept.
This request was born out of the following discussion relating to swagger-editor / swagger-ui swagger-api/swagger-editor#1410 (comment)