diff --git a/README.md b/README.md index 6319d5e..6ba9cf7 100644 --- a/README.md +++ b/README.md @@ -145,13 +145,13 @@ This prevents redirect_uri manipulation attacks within the same origin. ### Without Redirect Headers (current OAuth) -**Client Website returns to Browser:** +**Server-side Client Website returns URL to Browser:** ```http HTTP/1.1 302 Found Location: https://as.example/authorize?client_id=abc&state=123&redirect_uri=... ``` -**Browser navigates, sends to AS:** +**Browser navigates to the URL, which is the AS:** ```http GET /authorize?client_id=abc&state=123&redirect_uri=... Host: as.example @@ -164,7 +164,7 @@ HTTP/1.1 302 Found Location: https://app.example/cb?code=SplxlOBe&state=123 ← Leaked in URL ``` -**Browser sends code to Client Website:** +**Browser sends code to Server-Side Client Website to complete the code exchange:** ```http GET /cb?code=SplxlOBe&state=123 ← In browser history, logs, analytics Host: app.example @@ -179,7 +179,7 @@ Referer: https://as.example/consent ← Third-party resources see code via Refe ### With Redirect Headers -**Client Website returns to Browser:** +**Server-side Client Website returns URL to Browser:** ```http HTTP/1.1 302 Found Location: https://as.example/authorize?client_id=abc&state=123 @@ -187,7 +187,7 @@ Redirect-Query: "client_id=abc&state=123" Redirect-Path: "/app1/" ``` -**Browser navigates, adds origin and forwards to AS:** +**Browser navigates to the URL, which is the AS:** ```http GET /authorize?client_id=abc&state=123 Host: as.example @@ -196,14 +196,14 @@ Redirect-Path: "/app1/" Redirect-Query: "client_id=abc&state=123" ``` -**AS validates and returns to Browser:** +**AS returns code to Browser:** ```http HTTP/1.1 302 Found Location: https://app.example/cb ← No parameters in URL! Redirect-Query: "code=SplxlOBe&state=123" ``` -**Browser forwards back to Client Website:** +**Browser sends code to Server-Side Client Website to complete the code exchange:** ```http GET /cb ← Clean URL Host: app.example