Subject: [OAUTH-WG] Extra "Authorization: Basic" lines in examples

From: Mike Jones <[email-masked]>
Date: Tue, 26 Jul 2011 04:27:33 +0000

In sections 4.1.3, 4.3.2, 4.4.2, and 6 of draft -20, the examples contain both the line "Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW" and credentials in the post body.  For instance, the example from 4.3.2 is:

     POST /token HTTP/1.1
     Host: server.example.com
     Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
     Content-Type: application/x-www-form-urlencoded;charset=UTF-8

     grant_type=password&username=johndoe&password=A3ddj3w

I believe that the "Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW" line should be deleted from all of these examples, as you either use Basic or credentials in the post body, but not both.

                                                            Thanks,
                                                            -- Mike

---

From: Shane B Weeden <[email-masked]>
Date: Tue, 26 Jul 2011 14:58:19 +1000

Mike - I don't think that's true for the resource owner password
credentials flow that you showed below.

The Authorization header is authenticating the client, the
username/password POST body params represent the resource owner.

From:	Mike Jones <[email-masked]>
To:	"[email-masked]" <[email-masked]>
Date:	26-07-11 02:31 PM
Subject:	[OAUTH-WG] Extra "Authorization: Basic" lines in examples
Sent by:	[email-masked]

In sections 4.1.3, 4.3.2, 4.4.2, and 6 of draft -20, the examples contain
both the line “Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW” and
credentials in the post body.  For instance, the example from 4.3.2 is:

     POST /token HTTP/1.1
     Host: server.example.com

I believe that the “Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW” line
should be deleted from all of these examples, as you either use Basic or
credentials in the post body, but not both.

                                                            Thanks,
                                                            -- Mike
 _______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Bob Van Zant <[email-masked]>
Date: Mon, 25 Jul 2011 22:02:06 -0700

The Authorization header in those examples is authorizing the client.
In 4.1.3 the /token URI requires HTTP basic authorization to access.

Section 2.4 talks about this more.

-Bob

---

From: Brian Campbell <[email-masked]>
Date: Mon, 25 Jul 2011 23:05:47 -0600

I believe those examples are okay.

The content in the post body is the grant while the HTTP Basic
Authorization header is the client authentication. They are two
different things.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 25 Jul 2011 22:24:01 -0700

There is nothing wrong with the examples.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Monday, July 25, 2011 9:28 PM
To: [email-masked]
Subject: [OAUTH-WG] Extra "Authorization: Basic" lines in examples

     POST /token HTTP/1.1
     Host: server.example.com

                                                            Thanks,
                                                            -- Mike