Subject: [OAUTH-WG] [Fwd: [oauth] Re: HTTP response for bad oauth_verifier?]

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 27 Aug 2009 16:18:39 -0600

<hat type="individual"/>

FYI.

- -------- Original Message --------
Subject: [oauth] Re: HTTP response for bad oauth_verifier?
Date: Thu, 27 Aug 2009 13:28:23 -0600
From: Peter Saint-Andre <[email-masked]>
Reply-To: [email-masked]
To: [email-masked]
References:
<[email-masked]>
<[email-masked]>

http://wiki.oauth.net/ProblemReporting has timestamp_refused (and also
verifier_invalid), but it unclear about the mapping between those more
specific conditions and the generic HTTP conditions. IMHO this needs to
be clarified in draft-ietf-oauth-authentication as the specs are worked
on in the Oauth WG:

http://tools.ietf.org/html/draft-ietf-oauth-authentication-01

http://tools.ietf.org/wg/oauth/

Peter

On 8/22/09 10:24 PM, Doug Kaye wrote:
> Same question for bad timestamps. The spec (paragraph 10) says
> timestamps must be >= previous timestamps but there's no HTTP 400/401
> string for this.
>
> On Aug 22, 7:59 pm, Doug Kaye <[email-masked]> wrote:
>> Spec 6.3.2 (service provider processing of access token request) says
>> to return an HTTP error if the oauth_verifier is bad. But Spec
>> paragraph 10 indicates neither whether a 400 or 401 should be returned
>> nor an appropriate text string. What is expected?

- --~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google
Groups "OAuth" group.
To post to this group, send email to [email-masked]
To unsubscribe from this group, send email to
[email-masked]
For more options, visit this group at
http://groups.google.com/group/oauth?hl=en
- -~----------~----~----~----~------~----~------~--~---