Subject: [OAUTH-WG] Basic questions about using the HTTP Authorization header

From: Andrew Arnott <[email-masked]>
Date: Sat, 26 Jun 2010 07:02:51 -0700

Can anyone point me to good reference material for understanding the
Authorization header in Section 5.1 of the OAuth 2.0 draft 8
spec<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header>
and
the WWW-Authenticate section 6?

Specifically, some questions I have are:

   1. How to properly escape the access token for inclusion in the header?
   (suppose a linefeed or null character were in the token... how to escape
   that?)
   2. What do RWS and OWS stand for?
   3. What is the "realm" value? Is the "service" string that is always set
   as its value a literal, or a placeholder?  What are some actual values that
   might appear?

I'm sure there's an RFC out there that describes all this stuff.  RFC 2617
is mentioned as a source for some of this, but "RWS" doesn't show up
anywhere in that RFC, for example, so I'm not sure where the best place is
to look this up in.

Thanks.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: "William Mills" <[email-masked]>
Date: Sat, 26 Jun 2010 09:42:05 -0700

I don't remember where I found it before, but OWS is Optional White
Space, and RWS is Required White Space.  There is also no BNF to define
access_token or refresh_token.  
 
For this spec to be implementable "all this stuff" has to be explicitly
defined....

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Andrew Arnott
	Sent: Saturday, June 26, 2010 7:03 AM
	To: OAuth WG ([email-masked])
	Subject: [OAUTH-WG] Basic questions about using the HTTP
Authorization header

	Can anyone point me to good reference material for understanding
the Authorization header in Section 5.1 of the OAuth 2.0 draft 8 spec
<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header>  and
the WWW-Authenticate section 6? 

	1.	How to properly escape the access token for inclusion in
the header? (suppose a linefeed or null character were in the token...
how to escape that?) 
	2.	What do RWS and OWS stand for? 
	3.	What is the "realm" value? Is the "service" string that
is always set as its value a literal, or a placeholder?  What are some
actual values that might appear? 

	I'm sure there's an RFC out there that describes all this stuff.
RFC 2617 is mentioned as a source for some of this, but "RWS" doesn't
show up anywhere in that RFC, for example, so I'm not sure where the
best place is to look this up in.

	Thanks.
	--
	Andrew Arnott
	"I [may] not agree with what you have to say, but I'll defend to
the death your right to say it." - S. G. Tallentyre