Subject: [OAUTH-WG] x-www-form-urlencoded

From: Anthony Nadalin <[email-masked]>
Date: Sat, 13 Aug 2011 03:29:15 +0000

In the text on the authorization and token endpoints an assumption is made that the query component of the URLs will be specified based on x-www-form-urlencoded. But in fact that is never explicitly stated. What is explicitly stated is that RFC 3986 section 3 has to be used (and then only for the authorization endpoint, not the token endpoint). But section 3 just defines what characters can be used in a query component, it says nothing about x-www-form-urlencoded. Suggest that the specification needs  to normatively state that we are requiring all authorization endpoints that use the query component to do so using x-www-form-urlencoded.  Where RFC 5552 comes into the picture is in cases where the request body is an html form. In that case it makes sense to natively encode the form content using UTF-8. So this only applies to OAuth requests that use the request body. So this would apply to sections 2.4.1, 3.1, 3.2, 4.1.3, 4.3.2 & 4.4.2. Really, anywhere that a request can be made in the request body

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 17 Aug 2011 00:13:10 -0700

This seems to include two separate items.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Anthony Nadalin
> Sent: Friday, August 12, 2011 8:29 PM
> To: OAuth WG ([email-masked])
> Subject: [OAUTH-WG] x-www-form-urlencoded
> 
> In the text on the authorization and token endpoints an assumption is made
> that the query component of the URLs will be specified based on x-www-
> form-urlencoded. But in fact that is never explicitly stated. What is explicitly
> stated is that RFC 3986 section 3 has to be used (and then only for the
> authorization endpoint, not the token endpoint). But section 3 just defines
> what characters can be used in a query component, it says nothing about x-
> www-form-urlencoded. Suggest that the specification needs  to normatively
> state that we are requiring all authorization endpoints that use the query
> component to do so using x-www-form-urlencoded. 

This issue was raised by Yaron and corrected for both endpoints as indicated on the other thread. The new text is:

          The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted
          ([W3C.REC-html401-19991224]) query component ([RFC3986] section 3.4), which MUST
          be retained when adding additional query parameters. The endpoint URI MUST NOT
          include a fragment component.

> Where RFC 5552 comes
> into the picture is in cases where the request body is an html form. In that
> case it makes sense to natively encode the form content using UTF-8. So this
> only applies to OAuth requests that use the request body. So this would
> apply to sections 2.4.1, 3.1, 3.2, 4.1.3, 4.3.2 & 4.4.2. Really, anywhere that a
> request can be made in the request body

I have no idea what this is about.

EHL