redirect_uri matching does not follow RFC3986

[jgresty]

redirect_uri matching does not follow RFC3986

[james-d-elliott]

Simple String Comparison is the current best security practice in OAuth 2.0 and is the requirement in the OpenID Connect 1.0 standard, as well as the upcoming OAuth 2.1 standard it's (likely but it's not published yet) becoming a requirement similar to in OpenID Connect 1.0. As such it's probably "most correct" to specifically look at what Simple String Comparison actually means. Syntax Based Normalization from what I can see is a different string comparison type.

Edit: For these reasons I'd argue that fosite is actually following the spec accurately, and the client implementations should normalize the redirect_uri prior to making the request or during the configuration provisioning steps. I do however wonder if there is merit in adding a method to the configurator that returns the redirect uri matching func as it may be useful in other scenarios which are not traditionally compliant.

RFC3986 Section 6.2 is the comparison ladder, but neither the OAuth 2.0 Current Best Practices, OAuth 2.1, or OpenID Connect 1.0 mention use of this comparison ladder; just the use of the singular comparison type within the ladder.

[aeneasr]

Thanks James, I agree with that. It's also mandated by the conformity test suite. Closing