dex
dex copied to clipboard
dexidp
allow empty redirect uris for confidential clients
Overview
Allow confidential clients to not require pre-registering their redirect URIs.
What this PR does / why we need it
The standards do not require that confidential clients have preregistered redirect URIs, that requirement is only for public clients. While confidential clients SHOULD use pre-configured redirect URIs, they are not essential their security. We also will not adopt wildcards in redirect URIs as per #448 since that would be an explicit violation of the standard.
Special notes for your reviewer
Just chiming in to say that this is a really useful addition to dex, and its a shame the previous PRs:
- #448
- #1783
were all closed without merging
