Subject: [OAUTH-WG] [Errata Rejected] RFC8252 (5848)

From: RFC Errata System <[email-masked]>
Date: Thu, 29 Aug 2019 21:48:52 -0700 (PDT)

The following errata report has been rejected for RFC8252,
"OAuth 2.0 for Native Apps".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid5848

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Bayard Bell <[email-masked]>
Date Reported: 2019-08-26
Rejected by: Benjamin Kaduk (IESG)

Section: Appendix B.1

Original Text
-------------
Apps can initiate an authorization request in the browser, without
the user leaving the app, through the "SFSafariViewController" class
or its successor "SFAuthenticationSession", which implement the in-
app browser tab pattern.  Safari can be used to handle requests on
old versions of iOS without in-app browser tab functionality.

Corrected Text
--------------
Apps can initiate an authorization request in the browser, without
the user leaving the app, through the "ASWebAuthenticationSession"
class or its successors "SFAuthenticationSession" and
"SFSafariViewController", which implement the in-app browser tab
pattern.  The first of these allows calls to a handler registered
for the AS URL, consistent with Section 7.2. The latter two classes,
now deprecated, can use Safari to handle requests on old versions of
iOS without in-app browser tab functionality.

Notes
-----
SFAuthenticationSession documentation reflects deprecated status:

https://developer.apple.com/documentation/safariservices/sfauthenticationsession

Here's the documentation for ASWebAuthenticationSession:

https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession
 --VERIFIER NOTES-- 
This sort of change to update for events since the time of publication is not appropriate for an erratum; errata are intended solely to indicate errors in a document that were errors at the time of publication.  A revision of the document or a new document with an "Updates:" relationship would be more appropriate ways to indicate that the situation has changed.

--------------------------------------
RFC8252 (draft-ietf-oauth-native-apps-12)
--------------------------------------
Title               : OAuth 2.0 for Native Apps
Publication Date    : October 2017
Author(s)           : W. Denniss, J. Bradley
Category            : BEST CURRENT PRACTICE
Source              : Web Authorization Protocol
Area                : Security
Stream              : IETF
Verifying Party     : IESG