globocom/oauth2u — Issue #31: If `client_id` missing don't redirect to `redirect_uri`
Author: igorsobreira
Created: 2012-01-27 03:24:05+00:00
State: open

The spec says:

> If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error, and MUST NOT automatically redirect the user-agent to the invalid redirection URI.

Currently the server returns 400 with error on body, and not 302, if missing `redirect_uri` (there is no way to validate it yet because we haven't implemented client registration yet).

But this should happen for missing or invalid `client_id` too.