title: loginpass OAuth client - incorrect behavior
body: <p>Edit: Seems like the redirect_uri stored in Session is not persisting across calls.</p>
  
  <p>Using loginpass as an OAuth2 client and the authlib server from <a href="https://github.com/authlib/example-oauth2-server" rel="nofollow noreferrer">The Example Repo</a> as the OAuth2 server. </p>
  
  <p>Using this code in loginpass</p>
  
  <pre><code> bp = create_flask_blueprint(backend, oauth, handle_authorize)
   app.register_blueprint(bp, url_prefix='/{}'.format(backend.OAUTH_NAME))
  </code></pre>
  
  <p>In the authorization step, loginpass sends out a redirect_uri parameter to the OAuth2 Server. The server responds with the auth code, and then loginpass requests a token, but does not include the redirect_uri.</p>
  
  <p>OAuth2 raises an InvalidRequestError while processing the request because (per section 4.1.3 of RFC 6749) </p>
  
  <blockquote>
    <p>redirect_uri
             REQUIRED, if the "redirect_uri" parameter was included in the
             authorization request as described in Section 4.1.1, and their
             values MUST be identical.</p>
  </blockquote>
  
  <p>The server code that raises InvalidRequestError</p>
  
  <pre><code> redirect_uri = self.request.redirect_uri
   _redirect_uri = authorization_code.get_redirect_uri()
   original_redirect_uri = _redirect_uri or None
   if redirect_uri != original_redirect_uri:
       raise InvalidRequestError('Invalid "redirect_uri" in request.')
  </code></pre>