> Judging by your response, it's clear that there isn't a bug, and you either just don't know how OAuth works or you don't understand what an active session is. OAuth doesn't require an active session on a website, and an active session is having a page loaded in your browser.
The OAuth web flow requires an active session on dropbox.com. Without an active session Dropbox can not verify who the user is.
You still didn't answer my question about how a frame would help. Iframes should never be used to to embed OAuth provider authorization pages and embedding dropbox.com in general would be pretty useless if the user does not have an active session open.
As far as active sessions go dropbox.com is going to have two kinds authenticated and anonymous. Since we are clearly talking about access to users Dropbox accounts the only type of active session that would be useful would be authenticated.
> You still didn't answer my question about how a frame would help.
I thought you were saying that you couldn't get the Dropbox API authenticated using OAuth working unless you had a continuous active session on dropbox.com. Sorry for the misunderstanding.
The OAuth web flow requires an active session on dropbox.com. Without an active session Dropbox can not verify who the user is.
You still didn't answer my question about how a frame would help. Iframes should never be used to to embed OAuth provider authorization pages and embedding dropbox.com in general would be pretty useless if the user does not have an active session open.
As far as active sessions go dropbox.com is going to have two kinds authenticated and anonymous. Since we are clearly talking about access to users Dropbox accounts the only type of active session that would be useful would be authenticated.