Subject: [OAUTH-WG] HTTP responses

From: Werner Strydom <[email-masked]>
Date: Mon, 26 Mar 2012 23:41:38 -0700

Sections 4.1.4, 4.3.3, 5.1 and 5.2 requires that entity bodies in HTTP responses be in "application/json".  Is my understanding correct? If so, this is awkward for services that rely solely on XML formats for communication. 

Can the standard explicitly accommodate implementors that want to return other (agreed upon) formats based on the HTTP Accept header? For example, is a consumer requests a token from an Authorization Server with an accept Accept header of "text/xml" then the response will be formatted as XML. The schema describing that document can be standardized, if needed. If it is "application/json" the response will be formatted accordingly. In the case of unsupported formats, the authorization server should return HTTP status code 406 to be consistent with the way HTTP works.

Thanks,
Werner

---

From: "Richer, Justin P." <[email-masked]>
Date: Tue, 27 Mar 2012 14:20:40 +0000

Werner,

I have an extension draft to address this exact problem:

  http://tools.ietf.org/html/draft-richer-oauth-xml-00

I'm updating it to track the latest spec's section numbers (now that things have settled) and will upload it as soon as the IETF allows. For your benefit (and the WG in case anyone is interested) I'm attaching the PDF version of the draft-in-progress here.

I welcome any comments, suggestions, and questions.

 -- Justin

On Mar 27, 2012, at 2:41 AM, Werner Strydom wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Werner Strydom <[email-masked]>
Date: Tue, 27 Mar 2012 20:28:05 -0700

Justin,

I had a quick look.

You may want to include "text/xml" as a valid xml media type since it is widely used. Additional things to consider includes using XML Schema (XSD) to describe the XML documents. It may also be useful to investigate with one should use XML namespaces or custom media types to differentiate OAuth 2.0 responses from other xml documents.

For example, I'm writing a REST service which returns HTTP status 400 when invalid data was passed. The resulting document is in "text/xml" format yet conforms to a very different schema than the proposed OAuth xml documents. How do we make this really simple for clients to know what is coming down the line?

This makes one wonder why the standard proposes we should return 400 when in reality is should return 403 (Forbidden) when you are not authorized. 

Thanks,
Werner

---

From: Martin Thomson <[email-masked]>
Date: Wed, 28 Mar 2012 05:56:22 +0200

Accepted wisdom says that you create a MIME media type in these sorts
of scenarios.