Subject: Re: [OAUTH-WG] Proposed change to OAuth parameters registry

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 5 Apr 2011 15:54:16 -0700

Didn't receive any objections to this change. Will apply to -14.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Tuesday, March 29, 2011 4:14 PM
To: OAuth WG
Subject: [OAUTH-WG] Proposed change to OAuth parameters registry

I would like to make the following change to section 8.2:

   New request or response parameters for use with the authorization

   endpoint or the token endpoint are defined and registered in the

   parameters registry following the procedure in Section 10.2<http://tools.ietf.org/html/draft-ietf-oauth-v2-13#section-10.2>.

   Parameter names MUST conform to the param-name ABNF and parameter

   values syntax MUST be well-defined (e.g., using ABNF, or a reference

   to the syntax of an existing parameter).

   Unregistered vendor-specific parameter extensions that are not commonly

   applicable, and are specific to the implementation details of the

   authorization server where they are used SHOULD utilize a

   vendor-specific prefix that is not likely to conflict with other

   registered values (e.g. begin with 'companyname_').

This is a more pragmatic (and less ugly) solution to vendor specific parameters. Instead of using the 'x_' prefix, vendors (have and) will use something else that is unique to them. For example Facebook uses 'fb_' for many of their parameters.

Feedback requested by 4/1 for inclusion in -14.

EHL

---

From: Eliot Lear <[email-masked]>
Date: Wed, 06 Apr 2011 11:59:28 +0200

Sorry for the late comment on this, Eran.  I like your idea, but would
suggest that better than company name would be domain name or based on
domain name (I don't recall if '.' is allowed in this context).  Company
names are by no means unique, and even within a large company one could
envision clashes.

Eliot

On 3/30/11 1:13 AM, Eran Hammer-Lahav wrote:
>    parameters registry following the procedure in Section 10.2 <http://tools.ietf.org/html/draft-ietf-oauth-v2-13#section-10.2>.
>  
> This is a more pragmatic (and less ugly) solution to vendor specific
> parameters. Instead of using the ‘x_’ prefix, vendors (have and) will
> use something else that is unique to them. For example Facebook uses
> ‘fb_’ for many of their parameters.
>
>  
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 6 Apr 2011 07:19:16 -0700

Hi Eliot,

Prefixing query parameter names with a full domain is not likely to be an acceptable style. For example, Facebook uses fb_ as their prefix (most of the time) but my guess is not likely to go with fb.com.param or fb.com_param, not to mention facebook.com.param.

I think the consensus here is that some collisions between vendors are going to happen and that’s it ok. When new registered extension are introduced, vendors will need to figure out how to work alongside.

EHL

From: Eliot Lear [mailto:[email-masked]]
Sent: Wednesday, April 06, 2011 2:59 AM
To: Eran Hammer-Lahav
Cc: OAuth WG
Subject: Re: [OAUTH-WG] Proposed change to OAuth parameters registry

Sorry for the late comment on this, Eran.  I like your idea, but would suggest that better than company name would be domain name or based on domain name (I don't recall if '.' is allowed in this context).  Company names are by no means unique, and even within a large company one could envision clashes.

Eliot

This is a more pragmatic (and less ugly) solution to vendor specific parameters. Instead of using the ‘x_’ prefix, vendors (have and) will use something else that is unique to them. For example Facebook uses ‘fb_’ for many of their parameters.

EHL

OAuth mailing list

[email-masked]<mailto:[email-masked]>