DuendeSoftware
More options for redirect_uri validation
e.g. with JAR and PAR the spec allows more flexibility in validation. As of today the validator does not have that context.
The idea would be to pass the validated request as a context param. Maybe we could add a new method on the interface with a default implementation to avoid the breaking change.
The concern here is that passing the ValidatedRequest will only be partially populated based on where we perform URL validation. This means that only some of the context params are usable, but passing the whole ValidatedRequest seems confusing and too much. @leastprivilege @bigheadedmonster
Maybe it's sufficient to pass over the raw request collection and/or any RequestObjectValues collected at this point in time.
The things we need are Parameters, RequestObjectValues (if signed) and client context. Seems like a good fit for a new/specialized context class? :=) (and consider putting in a RequestSigned : bool, helper property)
Those things together give much control and power, as you can decorate the duence client object using your other interfaces.
Draft PR opened -- have a look to see if that's sufficient of if there's something else. Thanks.