Core - 3.1.2.6 para 3: Clarification proposal

[Nat Sakimura]

Paragraph 3 states:

Unless the Redirection URI is invalid, the Authorization Server returns the Client to 
the Redirection URI specified in the Authorization Request with the appropriate 
error and state parameters. Other parameters SHOULD NOT be returned.

It is ambiguous on what is to be done if the Redirection URI is invalid.

Propose adding:

If the Redirection URI is invalid, the Authorization Server MUST NOT 
return the user to the Redirection URI provided in the Authorization Request.

[Charles Romestant]

Just want to +1 this.

[Michael Jones]

Fixed #999 - Clarified requirements when invalid Redirection URI supplied

→ <<cset 053c16edd9fe>>