Subject: [OAUTH-WG] Working Group Last Call on "OAuth 2.0 for Native Apps"

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 21 Jul 2016 10:05:42 +0200

Hi all,

William has submitted an update, as promised during the OAuth WG session
on Monday. Hence, we will start a Last Call for comments on the "OAuth
2.0 for Native Apps"  specification.

The document can be found here:
https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03

Please have your comments in no later than August 8th.

Ciao
Hannes & Derek

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 24 Jul 2016 19:30:33 +0200

Hi,

generally, I considers this a highly valuable contribution and support 
to move it forward.

Some nits:

section 7.3, last paragraph: "... as it is less susceptible
    to misconfigured routing and client side firewalls Note ..." - I 
think a period is missing between "firewalls" and "Note" potentially a 
line break would be appropriate.

section 8.2 - The term PKCE is used in the second paragraph but not 
defined before the fourth paragraph. I suggest to define PKCE on first use.

best regards,
Torsten.

Am 21.07.2016 um 10:05 schrieb Hannes Tschofenig:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Wed, 27 Jul 2016 15:48:29 -0600

I likewise believe there is a lot of value in this work and support the
document moving forward.

I reviewed -03 and have just a couple nits:

Loopback URI Redirection in section 3
<https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03#section-7.3>
(which the author is already aware of because he mentioned it to me)
doesn't fully account for how a path component of the URI would be used to
allow a client to use and rely on distinct per-AS redirect URIs.

Appendix A.1.  iOS Implementation Details
<https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03#appendix-A.1>
has "Clients SHOULD use Universal Links for authorization requests ... "
but, in the context of what's being discussed there, shouldn't it say to
use Universal Links for *redirect URIs*? Or am I confused here?

On Sun, Jul 24, 2016 at 11:30 AM, Torsten Lodderstedt <
[email-masked]> wrote:

> Hi,
>
> generally, I considers this a highly valuable contribution and support to
> move it forward.
>
> Some nits:
>
>    to misconfigured routing and client side firewalls Note ..." - I think
> a period is missing between "firewalls" and "Note" potentially a line break
> would be appropriate.
>
> The document can be found here:https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03
>
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>
>

---

From: Ulrich Herberg <[email-masked]>
Date: Sat, 30 Jul 2016 16:32:08 -0700

Hannes,

I think this is a good document and support it. Still, I asked
questions that have never been responded to on this list:
https://www.ietf.org/mail-archive/web/oauth/current/msg16293.html

Is it possible to address my comments during the WGLC?

Best regards
Ulrich