Subject: [OAUTH-WG] Referencing client_secret when making requests

From: David Recordon <[email-masked]>
Date: Sat, 28 May 2011 09:40:42 -0700

In sections 4.1.3, 4.3.2, 4.4.2 and 6 there's a list of parameters
included within the request and then the sentence, "The client
includes its authentication credentials as described in Section 3."
Reading through the spec yesterday afternoon with Paul, we first
thought that client_secret was removed from these requests between
drafts 10 and 16. This is because the list of parameters is quite
obvious but this sentence referencing section 3 sort of just blends
in.

We'd propose changing this sentence to read, "The client includes its
authentication credentials as described in Section 3. Commonly the
client_secret parameter."

Goal being that client_secret is exposed within each section
describing how to make a request in a way that holds true for most
usage but doesn't make it more confusing for clients working with SAML
(or other client authentication credentials).

--David

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 29 May 2011 09:16:48 -0700

We can add it as an example. Instead of 'Commonly', 'For example, using'.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of David Recordon
> Sent: Saturday, May 28, 2011 9:41 AM
> To: OAuth WG
> Cc: paul Tarjan
> Subject: [OAUTH-WG] Referencing client_secret when making requests
> 
> In sections 4.1.3, 4.3.2, 4.4.2 and 6 there's a list of parameters included within
> the request and then the sentence, "The client includes its authentication
> credentials as described in Section 3."
> Reading through the spec yesterday afternoon with Paul, we first thought
> that client_secret was removed from these requests between drafts 10 and
> 16. This is because the list of parameters is quite obvious but this sentence
> referencing section 3 sort of just blends in.
> 
> Goal being that client_secret is exposed within each section describing how
> to make a request in a way that holds true for most usage but doesn't make
> it more confusing for clients working with SAML (or other client
> authentication credentials).
> 
> --David
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth