Subject: Re: [OAUTH-WG] Reevaluating Assumptions (Important!)

From: Justin Hart <[email-masked]>
Date: Wed, 30 Sep 2009 09:42:13 -0600

PHP, all of the above are possible (client and server) when using curl,
'raw' fsockopen, HttpRequest (almost all libraries like PEAR http request
and Zend Http Client use one of these)

Clients with HTTP libraries based on a browser (Javascript in a browser,
Flash (Air?), Java applets, Apache HttpClient, .NET, iPhone etc) the
response body is hidden (the headers too? ) for anything other than a 200.
This has, in my experience, made using these technologies hard to use at
times.

With the discussion on hashing methods - should we figure out which
platforms have acceptable (fast enough and working) implementations of the
other algorithms as well?  (It looks like at least PHP5 supports sha256 it
with hash_hmac, and theres a js impl by Paul Johnston (same as the google
code oauth lib uses for sha1)).

---------- Forwarded message ----------
From: Eran Hammer-Lahav <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Tue, 29 Sep 2009 09:34:54 -0700
Subject: Re: [OAUTH-WG] Reevaluating Assumptions (Important!)

Please help conduct the platform survey. Please answer this about the
platforms you use for developing HTTP applications. Does it provide access
to:

* the raw HTTP request URI
* HTTP authentication headers (WWW-Authenticate, Authorize)
* the Host HTTP header
* the raw HTTP request entity-body

If we have wide enough support (3 years later) for these items, we can
significantly simplify the signature workflow. If no one is going to reply
with information about the platforms they use I am going to assume that they
can (both client and server side) access all of the above.

Please reply back by 10/6.

EHL