Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-bearer-12.txt

From: [email-masked]
Date: Thu, 27 Oct 2011 14:00:29 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Web Authorization Protocol Working Group of the IETF.

	Title           : The OAuth 2.0 Authorization Protocol: Bearer Tokens
	Author(s)       : Michael B. Jones
                          Dick Hardt
                          David Recordon
	Filename        : draft-ietf-oauth-v2-bearer-12.txt
	Pages           : 19
	Date            : 2011-10-27

   This specification describes how to use bearer tokens in HTTP
   requests to access OAuth 2.0 protected resources.  Any party in
   possession of a bearer token (a &quot;bearer&quot;) can use it to get access to
   granted resources (without demonstrating possession of a
   cryptographic key).  To prevent misuse, the bearer token needs to be
   protected from disclosure in storage and in transport.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-oauth-v2-bearer-12.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-oauth-v2-bearer-12.txt

---

From: "Manger, James H" <[email-masked]>
Date: Fri, 28 Oct 2011 10:30:59 +1100

The <error-desc> value should just be <quoted-string>.
The current ABNF implies you can include raw (unescaped) " and \ characters in the value (as they are chars in <VCHAR>) - but that breaks parsing.
If the intention was not to allow senders to use escapes then <error-desc-char> needs to be <%x20-%x21 / %x23-5B / %x5D-7E>. If that is the intention why not disallow escapes from <error> as well?

Section 3 "The WWW-Authenticate Response Header Field"
OLD:
error-desc      = "error_description" "=" DQUOTE *error-desc-char DQUOTE
error-desc-char = SP / VCHAR
NEW:
error-desc      = "error_description" "=" quoted-string

The note about being allowed to parse <scope> with a quoted-string parser should also apply to <error-desc> and <error-uri> as well.

Perhaps a better approach is to: defined <scope>, <error>, <error-desc>, and <error-uri> values as <quoted-string>; add text saying senders MUST NOT use quoted-string's escape mechanism (so " and \ cannot appear in the values), though receivers MAY use a standard quoted-string parser; say the <error-uri> value must match <URI-reference>; say the <scope> value is a list of space-delimited, case sensitive strings.

NEW:
  scope = "scope" "=" quoted-string
  error = "error" "=" quoted-string
  error-desc = "error_description" "=" quoted-string
  error-uri = "error_uri" "=" quoted-string

  Senders MUST NOT use the quoted-string escape mechanism for
  "scope", "error", "error_description", or "error_uri" values.
  That is, those values cannot include " or \.
  Receivers MAY use a standard quoted-string parser, and hence
  accept some values that are not allowed to be sent.

  An "error_uri" value MUST match the URI-reference rule
  from [RFC3986].

  The "scope" value is a list of space-delimited, case sensitive
  strings. ...

P.S. trivial typo: "URI-Reference" should be "URI-reference" in §1.1.

--
James Manger

---

From: Julian Reschke <[email-masked]>
Date: Fri, 28 Oct 2011 10:59:04 +0200

On 2011-10-28 01:30, Manger, James H wrote:
> ...
> Perhaps a better approach is to: defined<scope>,<error>,<error-desc>, and<error-uri>  values as<quoted-string>; add text saying senders MUST NOT use quoted-string's escape mechanism (so " and \ cannot appear in the values), though receivers MAY use a standard quoted-string parser; say the<error-uri>  value must match<URI-reference>; say the<scope>  value is a list of space-delimited, case sensitive strings.
> ...

This goes into the right direction.

I would also allow both token and quoted-string, because it seems to be 
totally pointless to forbid it.

(I'll send a longer summary about open issues soonish))

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Sat, 29 Oct 2011 11:20:38 +0200

On 2011-10-28 10:59, Julian Reschke wrote:
>> Perhaps a better approach is to: defined<scope>,<error>,<error-desc>,
>> and<error-uri> values as<quoted-string>; add text saying senders MUST
>> NOT use quoted-string's escape mechanism (so " and \ cannot appear in
>> the values), though receivers MAY use a standard quoted-string parser;
>> say the<error-uri> value must match<URI-reference>; say the<scope>
>> value is a list of space-delimited, case sensitive strings.
>> ...
>

In the HTTPbis WG:

Ticket: <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/320>

Change Proposal: 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2011OctDec/0120.html>

Feedback appreciated,

Julian