Subject: [OAUTH-WG] error_description USASCII-encoded - is this a difficulty?

From: Todd W Lainhart <[email-masked]>
Date: Thu, 17 Jan 2013 13:09:17 -0500

We're working on an OAuth 2.0 AS, with extensions defined for session 
mgmt.  We're trying to adopt uniformly the error reporting mechanism in 
6749.

I'm now realizing that the error_description response in specified to be 
USASCII.  I was assuming that the error message could be UTF-8 encoded, 
such that I could return error messages in the client's locale.  E.G. 
consider the client credentials grant.  The store on the AS holding the 
registration is down, so I'd like to return a 500 with an error message 
from the store, from a catalog mapped to the client's language.

I've wondered about adding an additional response parameter, something 
like error_description_locale, but thought that there might be better 
practices out there.  I'm also wondering about the USASCII constraint on 
error_description.  I'm a long-time reader of this list, but I'm not 
recalling the background on this.

Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
[email-masked]

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 18 Jan 2013 11:40:36 +0200

Hi Todd, 

it is important to note that the error_description is not meant to be shown to the end users.
That was the reason for not introducing internationalization support. 

If you want to provide some additional information about the error description in other languages I would suggest to use the error_uri to point the developer to that information. 

Ciao
Hannes

On Jan 17, 2013, at 8:09 PM, Todd W Lainhart wrote:

> We're working on an OAuth 2.0 AS, with extensions defined for session mgmt.  We're trying to adopt uniformly the error reporting mechanism in 6749. 
> 
> I'm now realizing that the error_description response in specified to be USASCII.  I was assuming that the error message could be UTF-8 encoded, such that I could return error messages in the client's locale.  E.G. consider the client credentials grant.  The store on the AS holding the registration is down, so I'd like to return a 500 with an error message from the store, from a catalog mapped to the client's language. 
> 
> I've wondered about adding an additional response parameter, something like error_description_locale, but thought that there might be better practices out there.  I'm also wondering about the USASCII constraint on error_description.  I'm a long-time reader of this list, but I'm not recalling the background on this.
> 
> 
> 
> 
> Todd Lainhart
> Rational software
> IBM Corporation
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Todd W Lainhart <[email-masked]>
Date: Fri, 18 Jan 2013 08:43:23 -0500

Hi  Hannes -

Providing localization support indirectly via the error_uri was the 
conclusion that we were coming to, so thanks for responding and confirming 
that.

Best wishes -- Todd

Todd Lainhart
Rational software
IBM Corporation

From:   Hannes Tschofenig <[email-masked]>
To:     Todd W Lainhart/Lexington/IBM@IBMUS, 
Cc:     Hannes Tschofenig <[email-masked]>, [email-masked], 
[email-masked]
Date:   01/18/2013 04:42 AM
Subject:        Re: [OAUTH-WG] error_description USASCII-encoded - is this 
a difficulty?

Hi Todd, 

it is important to note that the error_description is not meant to be 
shown to the end users.
That was the reason for not introducing internationalization support. 

If you want to provide some additional information about the error 
description in other languages I would suggest to use the error_uri to 
point the developer to that information. 

Ciao
Hannes