diff --git a/97.md b/97.md index f268b997..c89f7a5e 100644 --- a/97.md +++ b/97.md @@ -24,10 +24,18 @@ The response MUST be a JSON object, with the format: ```json { "status": <"success" or "error">, - "message": + "message": , + "redirect_url": } ``` +For `redirect_url`, this should be used to bring the user to where they were while initiating the login process (now with the login complete). +This should be used in a way that is compatible with a different device being used to authorize the sign in than the one being logged in on. +An example for this is checking if the sign in was attempted from this device with a cookie, if so, redirect the user to where wanted to log in, +otherwise show a "continue on device" message. + +The `redirect_url` SHOULD be shown to the user and in a way that indicates it will take the user back to the app, such as `Return to website`. + HTTPS should always be used except for `.onion` services, which should be contacted using HTTP. Clients MAY or MAY NOT decide to implement support for `.onion` services.