Subject: [OAUTH-WG] draft-ietf-oauth-v2-bearer-10

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 20 Oct 2011 09:14:28 -0700

Section 2 of draft-ietf-oauth-v2-bearer-10 describes three methods of sending bearer access tokens in resource requests to resource servers, namely
  1) Authorization Request Headers (described in Section 2.1)
  2) Form-Encoded Body Parameter (described in Section 2.2)  
  3) URI Query Parameter (described in Section 2.3)

The specification recommends to use Authorization Request Headers and discourages the other two methods. 
Unfortunately, there is no background provided why we still describe them. 

Could someone provide text justifying why they are in there? 

Ciao
Hannes

---

From: "Richer, Justin P." <[email-masked]>
Date: Thu, 20 Oct 2011 16:21:53 +0000

I don't think we need text in the spec itself, but I do have explanation: 

1) It's very common current practice
2) In many cases, the client doesn't have access to the headers in any appreciable way
3) A URL with all parameters including authorization is a powerful artifact which can be passed around between systems as a unit (this is something I wish the MAC token spec allowed as well)

 -- Justin
________________________________________
From: [email-masked] [[email-masked]] on behalf of Hannes Tschofenig [[email-masked]]
Sent: Thursday, October 20, 2011 12:14 PM
To: OAuth WG
Subject: [OAUTH-WG] draft-ietf-oauth-v2-bearer-10

Ciao
Hannes

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth