+1 Phil
@independentid www.independentid.com [email protected] On 2011-10-17, at 11:53 AM, Eran Hammer-Lahav wrote: > All I agree with is to limit the scope character-set in the v2 spec to the > subset of ASCII allowed in HTTP header quoted-string, excluding " and \ so no > escaping is needed, ever. > > EHL > >> -----Original Message----- >> From: Hannes Tschofenig [mailto:[email protected]] >> Sent: Monday, October 17, 2011 8:25 AM >> To: Eran Hammer-Lahav >> Cc: Hannes Tschofenig; John Bradley; Richer, Justin P.; OAuth WG >> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >> Proposed Resolutions >> >> It is good that we have an agreement among a few people that more text >> needs to be provided in the core specification on the issue of the scope >> element. >> >> Now, there is still the question of what the text should say. The questions >> from my earlier mails are therefore still applicable and need an answer. >> >> Ciao >> Hannes >> >> On Oct 17, 2011, at 7:27 AM, Eran Hammer-Lahav wrote: >> >>> I agree. >>> >>> EHL >>> >>>> -----Original Message----- >>>> From: John Bradley [mailto:[email protected]] >>>> Sent: Monday, October 17, 2011 6:07 AM >>>> To: Richer, Justin P. >>>> Cc: Eran Hammer-Lahav; OAuth WG >>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >>>> Proposed Resolutions >>>> >>>> The scopes cross all of the profiles. >>>> >>>> I expect that restricting the character sets for bearer tokens, MAC, >>>> and other future variants should be dealt with in those profiles. >>>> >>>> Without restricting scope in core, we leave the possibility of coming >>>> up with different rules in different profiles e.g. MAC vs Bearer. >>>> >>>> It is probably best to have one rule in core that works across all the >> profiles. >>>> >>>> John B. >>>> On 2011-10-16, at 7:19 PM, Richer, Justin P. wrote: >>>> >>>>> I think the limit makes sense, but then are tokens limited by the >>>>> same >>>> rules? They need to live in all the same places (query parameters, >>>> headers, >>>> forms) that scopes do and would be subject to the same kinds of >>>> encoding woes that scopes will. Or am I missing something obvious as >>>> to why this isn't a problem for tokens (both bearer tokens and the >>>> public part of MAC tokens) but is a problem for scope strings? >>>>> >>>>> -- Justin >>>>> ________________________________________ >>>>> From: [email protected] [[email protected]] on behalf of >>>>> John Bradley [[email protected]] >>>>> Sent: Sunday, October 16, 2011 8:11 PM >>>>> To: Eran Hammer-Lahav >>>>> Cc: OAuth WG >>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >>>> Proposed Resolutions >>>>> >>>>> Restricting it now in the core spec is going to save a lot of headaches >> later. >>>>> >>>>> John B. >>>>> On 2011-10-16, at 3:54 PM, Eran Hammer-Lahav wrote: >>>>> >>>>>> It's an open question for the list. >>>>>> >>>>>> EHL >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Julian Reschke [mailto:[email protected]] >>>>>>> Sent: Sunday, October 16, 2011 11:00 AM >>>>>>> To: Mike Jones >>>>>>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); Hannes Tschofenig; OAuth >>>>>>> WG; Eran Hammer-Lahav >>>>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues >>>>>>> & Proposed Resolutions >>>>>>> >>>>>>> On 2011-10-16 18:44, Mike Jones wrote: >>>>>>>> As Eran wrote on 9/30, "The fact that the v2 spec allows a wide >>>>>>>> range of >>>>>>> characters in scope was unintentional. The design was limited to >>>>>>> allow simple ASCII strings and URIs." >>>>>>>> ... >>>>>>> >>>>>>> I see. Thanks. >>>>>>> >>>>>>> Is this going to be clarified in -23? >>>>>>> >>>>>>> Best regards, Julian >>>>>> _______________________________________________ >>>>>> OAuth mailing list >>>>>> [email protected] >>>>>> https://www.ietf.org/mailman/listinfo/oauth >>>>> >>>>> _______________________________________________ >>>>> OAuth mailing list >>>>> [email protected] >>>>> https://www.ietf.org/mailman/listinfo/oauth >>> >>> _______________________________________________ >>> OAuth mailing list >>> [email protected] >>> https://www.ietf.org/mailman/listinfo/oauth > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
