Support for loopback URIs with ephemeral ports for native clients? (RFC8252)
OK, this time I actually intend this question/issue for the rodauth-oauth project
I'm trying to implement oauth for with a native command-line client, using rodauth on the server side. As near as I can tell, best practice in this case is to use a loopback redirect URI with an ephemeral port dynamically allocated by the OS. According to RFC8252, in this case the server should loosen redirect URI matching to allow any port:
The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request.
-- https://www.rfc-editor.org/rfc/rfc8252#section-7.3
I can't seem to make this work; I'm getting redirect mismatch errors with dynamically allocated ports. Is this supported currently?