Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What's the difference between a Redirect url and a callback uri in openID Connect Oauth?

I was trying to learn how to implement openID connect in one of my Android app, I came across two terms redirect url and callback uri, I'm not able to distinguish between the two. What exactly is the difference?

like image 379
gameOne Avatar asked Feb 09 '17 05:02

gameOne


1 Answers

The official term is "Redirection Endpoint", see: https://www.rfc-editor.org/rfc/rfc6749#section-3.1.2:

3.1.2. Redirection Endpoint

After completing its interaction with the resource owner, the
authorization server directs the resource owner's user-agent back to
the client. The authorization server redirects the user-agent to the client's redirection endpoint previously established with the
authorization server during the client registration process or when
making the authorization request.

The redirection endpoint URI MUST be an absolute URI as defined by [RFC3986] Section 4.3. The endpoint URI MAY include an
"application/x-www-form-urlencoded" formatted (per Appendix B) query
component ([RFC3986] Section 3.4), which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a
fragment component.

but other terms like "Redirection URI", "Redirection URL", "Redirect URI", "Redirect URL", "Callback URL" and "Callback URI" etc. are all used interchangeably, some because in protocol fields the term gets shortened to things like redirect_uri, others because of inherited legacy terminology from similar protocols that pre-date OAuth 2.0.

like image 184
Hans Z. Avatar answered Oct 05 '22 22:10

Hans Z.