https redirect url

[sckott]

Curious why you require a secure url for redirect? What are examples of acceptable redirect url's ?

[cakesifu]

Hi @sckott

We're following the RFC 6749 recommendations for redirect endpoints confidentiality. The standard says that the redirection endpoint SHOULD require the use of TLS and if not, the authorization server should emit a warning to the user, however our security policies are a bit more strict and we're enforcing this as a MUST.

Any absolute url as defined in RFC 3986 section 4.3 should do, as long as the scheme is HTTPS. Here are a few examples:

• https://my-figshare-app.com/
• https://my-figshare-app.com/oauth/callback
• https://some.other.domain.com/callbacks/figshare.php

TL;DR: we're sending sensitive info (an authorization code) through this redirect endpoint. On unsecured networks, such as public WiFi, anyone can read that code unless the redirect endpoint is secured.

I hope this helps.

[sckott]

thanks for the quick response @cezar-berea - Using this from R, and we typically use http://localhost:1410 as a redirect URL when doing OAuth - If oauth flow is being done locally on someone's machine (not on a public website), would a http redirect url not lead to security problems?

[cakesifu]

When working locally it's safe to use http because there's no risk of traffic sniffing. I suppose we could make the validation smarter and allow http for localhost/127.0.0.1 hosts. We'll look into this and it in the backlog.

[sckott]

okay, thanks, seems hard to imagine the rfc wouldn't allow for localhost workflows, but i imagine that is an edge case

[sckott]

Thanks for looking into this @cezar-berea - AFAICT there's no way for our R client for figshare https://github.com/ropensci/rfigshare to work unless we can do a http redirect

[TomBaxter]

Any update on adding exception for localhost? This would be very helpful for local development against the API.

[carrn7k]

Is there any update on this? I'm currently unable to develop locally due to the https requirement for localhost.