Last modified: 2014-08-15 23:48:41 UTC
Instead of requiring callback to be "oob", OAuth should allow custom parameters to be passed together with a callback, verify that callback URL, but not query string, matches the registered callback, and then allow it. Currently you cannot protect yourself against CSRF attacks. If you would allow callbacks to provide custom query parameters in callback, then developers could pass an unique CSRF token and protect users. See examples: https://dev.twitter.com/discussions/19419
We are probably going to add this at some point (patches welcome!), but just to give the reason for how we currently do it: We require you to keep track of the request token's secret key (unlike twitter), so clients *must* track state with the user requesting the authorization (like the OAuth 1 spec says you should), and will hopefully prevent csrf. You should keep the key and secret in the user's session, and compare the key returned in the callback to the user's session to make sure this wasn't submitted via csrf. Twitter lets you do the handshake without keeping any state until the user finishes the authorization (you don't have to sign the access token request with the request token secret), and they pass the state token through to prevent csrf. So we're probably always going to require signing the access token request with the request token secret, but I agree, we should let you track state with a passed through parameter as well.
So in the code I am using, state is kept both on the serer side, but also passed through the client, see: https://github.com/meteor/meteor/blob/devel/packages/oauth1/oauth1_server.js#L43 query.state is what I should get back from the callback from you, this is used to get the tokens stored in the session, which is then compared to what was send along the callback in oauth_token. So I am OK with requiring state, but I would like to search in state by my own string and not by oauth_token.
I opened a pull request: https://gerrit.wikimedia.org/r/#/c/153983/
Change 153983 had a related patch set uploaded by CSteipp: Allow adding custom parameters to the callback for OAuth. https://gerrit.wikimedia.org/r/153983
