title: Redirecting to AIR app:/ scheme from remote URI in a WebKit iframe
body: <p>I'm attempting to implement OAuth2 in an AIR app that's running WebKit.  When the app starts, a local page is rendered (app:/login.html) which loads an iframe pointing to a remote site.  The remote site presents a login page, and upon submitting, should redirect back to app:/authenticated.html#access_token=1234xyz.  It appears that WebKit is barfing on the URL and not causing the iframe to redirect.  Redirects for URIs outside of the app:/ scheme appear to work.</p>
  
  <p>From the server's perspective, everything looks alright, as the command:</p>
  
  <pre><code>$ curl -k -v -d"email=bazquux@foo.bar.com&amp;password=blah" "https://foo.bar.com/oauth2/authorization?client_id=dd9766fc8042e70777b8857bee70f996&amp;edirect_uri=app%3A%2Fauthenticated.html&amp;response_type=token"
  </code></pre>
  
  <p>results in the following exchange (note the Location header is correct):</p>
  
  <pre><code>&gt; POST /oauth2/authorization?client_id=dd9766fc8042e70777b8857bee70f996&amp;redirect_uri=app%3A%2Fauthenticated.html&amp;response_type=token HTTP/1.1
  &gt; User-Agent: curl/7.21.2 (x86_64-apple-darwin10.3.1) libcurl/7.21.2 OpenSSL/1.0.0d zlib/1.2.5 libidn/1.19
  &gt; Host: foo.bar.com
  &gt; Accept: */*
  &gt; Content-Length: 40
  &gt; Content-Type: application/x-www-form-urlencoded
  &gt; 
  &lt; HTTP/1.1 302 Found
  &lt; Server: nginx/0.8.53
  &lt; Date: Mon, 23 May 2011 22:39:54 GMT
  &lt; Content-Type: text/html; charset=utf-8
  &lt; Connection: close
  &lt; Status: 302
  &lt; X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.0
  &lt; Location: app:/authenticated.html#access_token=44fab26915308753fd78ddd9e68c7a9c&amp;expires_in=899&amp;token_type=bearer
  &lt; X-Runtime: 1492
  &lt; Content-Length: 176
  &lt; Pragma: no-cache
  &lt; Set-Cookie: _session=BAh7BzoPc2Vzc2lvbl9pZCIlNWRmMDM5NWFmNDk0YjYxZDkwNDEzNGU1MzE2YzAwOTM6C3RlbmFudGkK--4e08d61ae521cf41f9f69b2257ad7599a675f35a; path=/; HttpOnly
  &lt; Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0, s-maxage=0
  &lt; Expires: Thu, 01 Jan 1970 00:00:00 +0000
  &lt; 
  &lt;html&gt;&lt;body&gt;You are being &lt;a href="app:/authenticated.html#access_token=44fab26915308753fd78ddd9e68c7a9c&amp;amp;expires_in=899&amp;amp;token_type=bearer"&gt;redirected&lt;/a&gt;.&lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>Any ideas as to how to get this working?</p>