Subject: [OAUTH-WG] [Technical Errata Reported] RFC6749 (4819)

From: RFC Errata System <[email-masked]>
Date: Wed, 5 Oct 2016 08:16:52 -0700 (PDT)

The following errata report has been submitted for RFC6749,
"The OAuth 2.0 Authorization Framework".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6749&eid=4819

--------------------------------------
Type: Technical
Reported by: Lars Kemmann <[email-masked]>

Section: 4.2.2

Original Text
-------------
HTTP/1.1 302 Found
Location: http://example.com/cb#
          access_token=2YotnFZFEjr1zCsicMWpAA
          &state=xyz&token_type=example&expires_in=3600

Corrected Text
--------------
HTTP/1.1 302 Found
Location: http://client.example.com/cb#
          access_token=2YotnFZFEjr1zCsicMWpAA
          &state=xyz&token_type=example&expires_in=3600

Notes
-----
In the example for section 4.2.1, the request was made with a `redirect_uri` parameter value of `redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb`. If I understand correctly, the `client` subdomain should be included in the `Location` header in the response.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6749 (draft-ietf-oauth-v2-31)
--------------------------------------
Title               : The OAuth 2.0 Authorization Framework
Publication Date    : October 2012
Author(s)           : D. Hardt, Ed.
Category            : PROPOSED STANDARD
Source              : Web Authorization Protocol
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: "Manger, James" <[email-masked]>
Date: Thu, 6 Oct 2016 09:07:43 +1100

This errata is not quite right. It needs to use https, not http.

Location: https://client.example.com/cb...

--
James Manger

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of RFC Errata System
Sent: Thursday, 6 October 2016 2:17 AM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: [OAUTH-WG] [Technical Errata Reported] RFC6749 (4819)

The following errata report has been submitted for RFC6749, "The OAuth 2.0 Authorization Framework".

Section: 4.2.2

Original Text
-------------
HTTP/1.1 302 Found

Corrected Text
--------------
HTTP/1.1 302 Found

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. 

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Lars Kemmann <[email-masked]>
Date: Thu, 6 Oct 2016 21:25:00 +0000

Ah, you’re right. Thanks! Should I resubmit it?

~Lars

From: Manger, James<mailto:[email-masked]>
Sent: Wednesday, October 5, 2016 6:07 PM
To: RFC Errata System<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: Lars Kemmann<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: [OAUTH-WG] [Technical Errata Reported] RFC6749 (4819)

--
James Manger

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of RFC Errata System
Sent: Thursday, 6 October 2016 2:17 AM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: [OAUTH-WG] [Technical Errata Reported] RFC6749 (4819)

Section: 4.2.2

Original Text
-------------
HTTP/1.1 302 Found

Corrected Text
--------------
HTTP/1.1 302 Found

Notes
-----

Instructions:
-------------

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 7 Oct 2016 15:26:35 -0400 (EDT)

> Ah, you’re right. Thanks! Should I resubmit it?

Kathleen can get it edited in-place.

-Ben