[OAUTH-WG] GitHub ships server

2010-06-01 Thread David Recordon
With support for the Web Server and User Agent flows. Desktop said to be coming soon and a few different scopes. GitHub doesn't support OAuth 1.0. http://support.github.com/discussions/api/28-oauth2-busy-developers-guide http://gist.github.com/419219 Rick, is this based off of draft 5? Cool

Re: [OAUTH-WG] GitHub ships server

2010-06-01 Thread Rick Olson
Partly draft 5 and partly the Facebook implementation :) Thanks for pinging me, I meant to find the OAuth list to ask for some clarifications on a few items. On Mon, May 31, 2010 at 11:29 PM, David Recordon record...@gmail.com wrote: With support for the Web Server and User Agent flows. Desktop

Re: [OAUTH-WG] FW: Duplicating request component in an HTTP authentication scheme

2010-06-01 Thread Richer, Justin P.
What I like about Brian's solution (a lot) is that you can at least see what the heck the client thought it was doing. When you're inside of a framework, your URL may get all kinds of munched up but you can usually tell if an incoming one makes sense to you in your framework-specific validation

Re: [OAUTH-WG] FW: Duplicating request component in an HTTP authentication scheme

2010-06-01 Thread Igor Faynberg
+1 Igor Richer, Justin P. wrote: What I like about Brian's solution (a lot) is that you can at least see what the heck the client thought it was doing. When you're inside of a framework, your URL may get all kinds of munched up but you can usually tell if an incoming one makes sense to you in

Re: [OAUTH-WG] Should replay of access token request be allowed?

2010-06-01 Thread Brian Eaton
On Sun, May 30, 2010 at 9:47 AM, Dick Hardt dick.ha...@gmail.com wrote: I think so. In WRAP the verification code was RECOMMENDED one time use. Yep. Servers must enforce time-limits on verification codes. Servers may make verification codes single use tokens. Clients must not attempt to

Re: [OAUTH-WG] Questions about scopes (section 6.1)

2010-06-01 Thread Torsten Lodderstedt
Is there anyone who can answer my questions? Am 30.05.2010 17:56, schrieb Torsten Lodderstedt: I have some questions regarding the WWW-Authenticate header's scope attribute. The spec states The scope attribute is a space-delimited list of URIs (relative or absolute) indicating the

Re: [OAUTH-WG] Questions about scopes (section 6.1)

2010-06-01 Thread Peter Saint-Andre
We discussed this a bit at the interim meeting, but I don't think we came to any consensus. On 6/1/10 12:46 PM, Torsten Lodderstedt wrote: Is there anyone who can answer my questions? Am 30.05.2010 17:56, schrieb Torsten Lodderstedt: I have some questions regarding the WWW-Authenticate

Re: [OAUTH-WG] Questions about scopes (section 6.1)

2010-06-01 Thread Torsten Lodderstedt
is there a protocol of the interim meeting? Am 01.06.2010 20:47, schrieb Peter Saint-Andre: We discussed this a bit at the interim meeting, but I don't think we came to any consensus. On 6/1/10 12:46 PM, Torsten Lodderstedt wrote: Is there anyone who can answer my questions? Am

Re: [OAUTH-WG] Questions about scopes (section 6.1)

2010-06-01 Thread Peter Saint-Andre
Do you mean minutes? The chairs are working on that, AFAIK. /psa On 6/1/10 1:20 PM, Torsten Lodderstedt wrote: is there a protocol of the interim meeting? Am 01.06.2010 20:47, schrieb Peter Saint-Andre: We discussed this a bit at the interim meeting, but I don't think we came to any

Re: [OAUTH-WG] user agent flow

2010-06-01 Thread Luke Shepard
Inline. On May 28, 2010, at 9:29 AM, Murali VP wrote: OAuth 2.0 authors or anyone with authority on the draft, would appreciate some response to the below items. 3.5. User-Agent Flow 1. It is not clear from the draft how a user agent flow would refresh an access token. There are

Re: [OAUTH-WG] Questions about scopes (section 6.1)

2010-06-01 Thread Dick Hardt
I don't recall any discussion at the level of detail that Torsten is asking about. My inclination would be the Client would include the what was returned in WWW-Authenticate in the access request call. On Tue, Jun 1, 2010 at 11:47 AM, Peter Saint-Andre stpe...@stpeter.imwrote: We discussed