Commit sur main · 0e900a7 · @aciccarello
Previously, the me value supplied by the client in the authorization request was signed directly into the authorization code. If that value differed from publication.me (e.g. a redirect URL), the issued token would fail verification at query time. Per the IndieAuth spec (sections 5.2, 5.3.2, 5.3.3), the authorization server may ignore the client-supplied me and return its own canonical profile URL. publication.me is now always used when signing the code. The client-supplied me is still echoed back in the redirect response for backwards compatibility. Fixes #911