Clarify authorization endpoint error responses
Clarified the OAuth 2.1 working-group draft's redirect safety requirements and error mappings for malformed authorization requests.
oauth-wg/oauth-v2-1 · #257
OAuth security clarification
The OAuth 2.1 draft now requires both client identity and redirect URI validation before redirecting authorization errors, reducing open-redirect ambiguity.
Problem
The draft prohibited redirects for an invalid client identifier in one paragraph but later discussed only invalid redirect URIs, leaving ambiguity about whether an authorization error could be redirected before both values were validated.
Approach
Requires validation of both the client identifier and redirect URI before any error redirect, distinguishes missing from unsupported `response_type`, maps rejected scope requests to `invalid_scope` without overriding server scope policy, and recommends HTTP 400 for direct user-agent errors rather than token-endpoint HTTP 401 behavior.
Impact and scope
- Removes wording ambiguity that could otherwise encourage unsafe authorization-endpoint redirects.
- Provides interoperable error behavior for missing identifiers, response types, redirect URIs, and rejected scopes.
- Preserves authorization-server discretion to reduce or ignore requested scope according to policy.
Validation
- Rendered the draft successfully through `kramdown-rfc`, XML-to-text, and XML-to-HTML checks using the repository's `make` workflow.
- The PR and two authored commits credit Goutam Adwant; the editor applied final wording suggestions and completed a GitHub-verified merge.
- The merged contribution closed GH-253; the repository did not publish a separate GitHub check suite for the branch.