From 77b8d8380c338278bee8e639834cd2e985a8c4be Mon Sep 17 00:00:00 2001 From: Kieran Klukas Date: Sun, 11 Jan 2026 14:38:30 -0500 Subject: [PATCH] bug: allow not sending redirect url --- src/routes/indieauth.ts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/routes/indieauth.ts b/src/routes/indieauth.ts index e484def..6219e88 100644 --- a/src/routes/indieauth.ts +++ b/src/routes/indieauth.ts @@ -1771,16 +1771,15 @@ export async function token(req: Request): Promise { } } - if (!code || !client_id || !redirect_uri) { - console.error("Token endpoint: missing parameters", { + if (!code || !client_id) { + console.error("Token endpoint: missing required parameters", { code: !!code, client_id: !!client_id, - redirect_uri: !!redirect_uri, }); return Response.json( { error: "invalid_request", - error_description: "Missing required parameters", + error_description: "Missing required parameters (code, client_id)", }, { status: 400 }, ); @@ -1875,8 +1874,9 @@ export async function token(req: Request): Promise { ); } - // Verify redirect_uri matches - if (authcode.redirect_uri !== redirect_uri) { + // Verify redirect_uri matches if provided (per OAuth 2.0 RFC 6749 section 4.1.3) + // redirect_uri is REQUIRED if it was included in the authorization request + if (redirect_uri && authcode.redirect_uri !== redirect_uri) { console.error("Token endpoint: redirect_uri mismatch", { stored: authcode.redirect_uri, received: redirect_uri, -- 2.51.2