CIBA: Redirects and the Client Notification Endpoint

[Dave Tonge]

I just want to check the reasoning for the current wording:

The Client SHOULD NOT return an HTTP 3xx code. 
The OP SHOULD NOT follow redirects.
All redirects MUST be HTTPS. 

I think this is saying:

• Client shouldn't have any redirects on their notification endpoint
• OPs shouldn't follow redirects if the client ignores this
• Even there are redirects then they must be HTTPS

Is my understanding correct and is the WG happy with this approach?

[Dave Tonge]

There was discussion of this and an agreement that redirects should not be allowed.

[Gonzalo Fernández]

So, If I understand well, only the 3rd sentence must change?, maybe dissapear?

[Dave Tonge]

yes - I'll open a pull request

[Dave Tonge]

https://bitbucket.org/openid/mobile/pull-requests/17/redirects/diff

But only this commit is relevant: https://bitbucket.org/dgtonge/mobile/commits/5b7704f72483026e909d6e49827c4d6764df5c71?at=default

[Brian Campbell]

revolved by merging pull request #17