AuthorizationController different behavior between responce_type=code and token on Rack::OAuth2 Sample Server (Bearer)

[fuminori ido]

Dear,

Let me ask the different behavior between two response_type(code/
token) on Rack::OAuth2 sample AuthorizationsController action.

I tried to access sample site: https://rack-oauth2-sample.heroku.com/
After registering client and doing authorization request on client
page
(https://rack-oauth2-sample.heroku.com/clients/##) by clicking the
link and pushing approve button,

1. when response_type = :code, the redirected url is as follows:

http://CLIENT_PATH?code=....

2. when response_type = :token, the redirected url is as follows
( '#', not '?' on access_token):

http://CLIENT_PATH#access_token=... # actual result
http://CLIENT_PATH?access_token=... # my expectation

Is this expected behavior? Please let me know.

[matake@gmail]

Yes, it's the expected behavior.
When redirect response includes an access token, all response parameters are included in the redirect URI fragment.

See "Implicit Grant" section in core spec for more details.
http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.2

[fuminori ido]

Thanks for your prompt reply. I understand that I need to learn
more...