Subject: [OAUTH-WG] Debug mode

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 2 Dec 2009 23:55:13 -0700

One of the most common requests I get is to add a debug mode to the protocol, allowing the client to request the server to provide the full signature base string when the signature check fails. Since this part does not affect security (since the base string is obvious from the request), it is a matter of preference whether we should specify such an interface.

Comments?

EHL

---

From: Ethan Jewett <[email-masked]>
Date: Thu, 3 Dec 2009 08:28:38 -0500

Unless this would somehow help clients to automatically deal with
error conditions, I don't think it belongs in the base spec. We can
certainly make some suggestion as to how to accomplish this for API
designers, but it seems like something that should be left to the
implementation.

Ethan

On Thu, Dec 3, 2009 at 1:55 AM, Eran Hammer-Lahav <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: George Fletcher <[email-masked]>
Date: Thu, 03 Dec 2009 09:06:53 -0500

+1

It's pretty easy to set up a http://example.com/debugOauth resource that 
takes the request and validates the signature, returning as much debug 
information as possible.

Thanks,
George

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 03 Dec 2009 07:21:15 -0700

<hat type='individual'/>

Agreed. I start to worry when a protocol needs a debug mode...

On 12/3/09 7:06 AM, George Fletcher wrote:
>>> One of the most common requests I get is to add a debug mode to the
>>> protocol, allowing the client to request the server to provide the
>>> full signature base string when the signature check fails. Since this
>>> part does not affect security (since the base string is obvious from
>>> the request), it is a matter of preference whether we should specify
>>> such an interface.
>>>
>>> Comments?
>>>
>>> EHL

---

From: Richard Barnes <[email-masked]>
Date: Thu, 3 Dec 2009 19:01:26 -1000

+1

Seems like a tool, not a protocol feature.

--Richard

On Dec 3, 2009, at 4:06 AM, George Fletcher wrote:

> +1
>
> It's pretty easy to set up a http://example.com/debugOauth resource  
> that takes the request and validates the signature, returning as  
> much debug information as possible.
>
> Thanks,
> George
>
> Ethan Jewett wrote:
>> On Thu, Dec 3, 2009 at 1:55 AM, Eran Hammer-Lahav <[email-masked] 
>> > wrote:
>>
>>> One of the most common requests I get is to add a debug mode to  
>>> the protocol, allowing the client to request the server to provide  
>>> the full signature base string when the signature check fails.  
>>> Since this part does not affect security (since the base string is  
>>> obvious from the request), it is a matter of preference whether we  
>>> should specify such an interface.
>>>
>>> Comments?
>>>
>>> EHL

---

From: John Panzer <[email-masked]>
Date: Thu, 3 Dec 2009 23:15:08 -0800

Well, except that most people will be interacting with this stuff through
libraries.  Which won't necessarily be granting direct access to whatever
extra flags specific services might add like debug headers or query
parameters.

It might be nice to define some simple, standard way to pass extra metadata
with each request that libraries could be aware of for purposes of
pass-through.  For protected resources there's already a URL under the
control of the client, but not necessarily for other endpoints acquired via
discovery etc.

--
John Panzer / Google
[email-masked] / abstractioneer.org / @jpanzer

On Thu, Dec 3, 2009 at 9:01 PM, Richard Barnes <[email-masked]> wrote:

>>>> protocol, allowing the client to request the server to provide the full
>>>> signature base string when the signature check fails. Since this part does
>>>> not affect security (since the base string is obvious from the request), it
>>>> is a matter of preference whether we should specify such an interface.
>>>>
>>>> Comments?
>>>>
>>>> EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 4 Dec 2009 00:36:28 -0700

This would be authentication specific, so debug is pretty much limited to returning the signature base string...

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of John Panzer
Sent: Thursday, December 03, 2009 11:15 PM
To: Richard Barnes
Cc: OAuth WG ([email-masked])
Subject: Re: [OAUTH-WG] Debug mode

Well, except that most people will be interacting with this stuff through libraries.  Which won't necessarily be granting direct access to whatever extra flags specific services might add like debug headers or query parameters.

It might be nice to define some simple, standard way to pass extra metadata with each request that libraries could be aware of for purposes of pass-through.  For protected resources there's already a URL under the control of the client, but not necessarily for other endpoints acquired via discovery etc.

--
John Panzer / Google
[email-masked]<mailto:[email-masked]> / abstractioneer.org<http://abstractioneer.org> / @jpanzer

On Thu, Dec 3, 2009 at 9:01 PM, Richard Barnes <[email-masked]<mailto:[email-masked]>> wrote:
+1

--Richard

It's pretty easy to set up a http://example.com/debugOauth resource that takes the request and validates the signature, returning as much debug information as possible.

Thanks,
George

Ethan Jewett wrote:

Ethan

On Thu, Dec 3, 2009 at 1:55 AM, Eran Hammer-Lahav <[email-masked]<mailto:[email-masked]>> wrote:
One of the most common requests I get is to add a debug mode to the protocol, allowing the client to request the server to provide the full signature base string when the signature check fails. Since this part does not affect security (since the base string is obvious from the request), it is a matter of preference whether we should specify such an interface.

Comments?

EHL
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: John Panzer <[email-masked]>
Date: Thu, 3 Dec 2009 23:41:58 -0800

So establish a loose convention of adding ?token_debug=1 to resource URLs
and move on?
--
John Panzer / Google
[email-masked] / abstractioneer.org / @jpanzer

On Thu, Dec 3, 2009 at 11:36 PM, Eran Hammer-Lahav <[email-masked]>wrote:

> This would be authentication specific, so debug is pretty much limited to
> returning the signature base string…
>
>
>
> EHL
>
>
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *John Panzer
> *Sent:* Thursday, December 03, 2009 11:15 PM
> *To:* Richard Barnes
> *Cc:* OAuth WG ([email-masked])
> *Subject:* Re: [OAUTH-WG] Debug mode
>
>
>

---

From: Hubert Le Van Gong <[email-masked]>
Date: Fri, 4 Dec 2009 10:09:54 +0100

I agree this might be useful but I don't think this belongs to the base spec.
Presumably most implementation already include some ways of retrieving
the request and all its headers, parameters.

Hubert

On Fri, Dec 4, 2009 at 8:41 AM, John Panzer <[email-masked]> wrote:
>> It might be nice to define some simple, standard way to pass extra
>> metadata with each request that libraries could be aware of for purposes of

---

From: "Vrancken Bart bv" <[email-masked]>
Date: Fri, 4 Dec 2009 10:11:12 +0100

I expect that the library will offer such a debug mode as a feature, but
that it is not included in the spec, because it doesn't bring extra
value to the protocol it self. 

And like Peter said, *ouch*, if the protocol needs a debug mode ...

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf
Of John Panzer
Sent: vrijdag 4 december 2009 8:15
To: Richard Barnes
Cc: OAuth WG ([email-masked])
Subject: Re: [OAUTH-WG] Debug mode

Well, except that most people will be interacting with this stuff
through libraries.  Which won't necessarily be granting direct access to
whatever extra flags specific services might add like debug headers or
query parameters.  

It might be nice to define some simple, standard way to pass extra
metadata with each request that libraries could be aware of for purposes
of pass-through.  For protected resources there's already a URL under
the control of the client, but not necessarily for other endpoints
acquired via discovery etc.

+1

--Richard

+1

Thanks,
George

Ethan Jewett wrote:

Ethan

On Thu, Dec 3, 2009 at 1:55 AM, Eran Hammer-Lahav <[email-masked]>
wrote:

One of the most common requests I get is to add a debug mode to the
protocol, allowing the client to request the server to provide the full
signature base string when the signature check fails. Since this part
does not affect security (since the base string is obvious from the
request), it is a matter of preference whether we should specify such an
interface.

Comments?

EHL